DOE-STD-1073-93 Part II, Guide for Operational Configuration Management Program

NOT MEASUREMENT SENSITIVE DOE-STD-1073-93-Pt.2 November 1993 DOE STANDARD GUIDE FOR OPERATIONAL CONFIGURATION MANAGEMENT PROGRAM Including the Adjunct Programs of Design Reconstitution and Material Condition and Aging Management PART ll U.S. Department of Energy AREA CMAN Washington, D.C. 20585 DISTRIBUTION STATEMENT A: Approved for public release; distribution Is unlimited. WELCOME This Portable Document Format (PDF) file contains bookmarks, thumbnails, and hyperlinks to help you navigate through the document. All items listed in the Contents are linked to the corresponding sections. In addition, if you click on a section heading while you are reading the text, you will return to the Contents. Click on the DOE seal below to move to the Contents page. This document has been reproduced directly from the best available copy. Available to DOE and DOE contractors from the Office of Scientific and Technical Information, P.O. Box 62, Oak Ridge, TN 37831; (615) 576-8401. Available to the public from the National Technical Information Service, U.S. Department of Commerce, 5285 Port Royal Rd., Springfield, VA 22161. Order No. DE94005408 i CONTENTS FOREWORD . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . i GLOSSARY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . ix ACRONYMS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xv BIBLIOGRAPHY . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . xvii PART I CHAPTER 1 OPERATIONAL CONFIGURATION MANAGEMENT PROGRAM PRINCIPLES 1.1 Program Objective . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–1 1.2 Functional Model . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–3 1.3 Program Criteria . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–4 1.3.1 Program Management Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–4 1.3.2 Design Requirements Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–7 1.3.3 Document Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–8 1.3.4 Change Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–9 1.3.5 Assessments Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–10 1.3.6 Design Reconstitution Adjunct Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–11 1.3.7 Material Condition and Aging Management Adjunct Program . . . . . . . . . . . . . I–13 1.4 Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–15 1.4.1 Introduction . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–15 1.4.2 General Process for Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–15 1.4.3 General Application of Graded Approach . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–24

Appendix I–A CM Program Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–A–1 Appendix I–B Background Material and Conceptsfor Operational Configuration Management . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–1 PART II CHAPTER 2 IMPLEMENTATION GUIDANCE FOR OPERATIONAL CONFIGURATION MANAGEMENT 2.1 Program Management Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–1 2.1.1 Program Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–1 2.1.2 Interfaces . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–8 2.1.3 Databases . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–9 2.1.4 Configuration Management Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–11 2.1.5 Specific Application of Graded Approach: Program Management Element . . . . . . . . II–15 2.2 Design Requirements Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–15 2.2.1 Establishment of Design Requirements and Design Basis . . . . . . . . . . . . . . . . . . . . . II–17 2.2.2 Assignment of SSC Grades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–24 2.2.3 Fully Developed Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–29 2.2.4 Specific Application of Graded Approach: Design Requirements Element . . . . . . . . . II–29 2.3 Document Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–29 2.3.1 Initial Development Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–29 2.3.2 Fully Developed Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–34 http://www.doe.gov/html/techstds/standard/std1073/s1073pt1.pdf ii 2.3.3 Specific Application of Graded Approach: Document Control Element . . . . . . . . . . . . II–38 2.4 Change Control Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–39 2.4.1 Initial Development Activities . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–39 2.4.2 Fully Developed Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–43 2.4.3 Specific Application of Graded Approach: Change Control Element . . . . . . . . . . . . . II–48 2.5 Assessments Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–48 2.5.1 Initial Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–48 2.5.2 Post-Implementation Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–54 2.5.3 Ongoing Assessments . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–55 2.5.4 Specific Application of Graded Approach: Assessments Element . . . . . . . . . . . . . . . II–59 CHAPTER 3 IMPLEMENTATION GUIDANCE FOR DESIGN RECONSTITUTION

3.1 Program Plans and Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–61 3.1.1 Design Reconstitution Program Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–61 3.1.2 Design Reconstitution Action Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–65 3.1.3 Design Reconstitution Program Governing and Implementing Procedures . . . . . . . . II–65 3.2 Identification and Retrieval of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–66 3.2.1 Identification and Retrieval of Source Documents . . . . . . . . . . . . . . . . . . . . . . . . . . . II–67 3.2.2 Extraction of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–70 3.3 Evaluation, Verification, and Validation of Design Information . . . . . . . . . . . . . . . . . . . . . . . . II–70 3.3.1 Verification of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–71 3.3.2 Technical Validation of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–71 3.3.3 Release of Verified and Validated Design Information . . . . . . . . . . . . . . . . . . . . . . . . II–71 3.3.4 Correlation of Design Basis to Design Requirements . . . . . . . . . . . . . . . . . . . . . . . . . II–73 3.3.5 Technical Management Review of Design Information . . . . . . . . . . . . . . . . . . . . . . . . II–73 3.4 Resolution of Discrepancies . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–74 3.5 Regeneration of Missing Critical Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–76 3.5.1 Regeneration of Design Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–76 3.5.2 Regeneration of Design Basis . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6 Preparation and Issuance of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6.1 Pilot Design Information Summary Program . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–78 3.6.2 Design Information Summary Format and Content Guide . . . . . . . . . . . . . . . . . . . . . II–78 3.6.3 Design Information Summary Layout Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–79 3.6.4 Design Information Summary Users' Guide . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.5 Final Verification of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.6 Issuance of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.7 Field Validation of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . II–80 3.6.8 Maintenance and Control of Design Information Summaries . . . . . . . . . . . . . . . . . . . II–81 3.7 Specific Application of Graded Approach: Design Reconstitution . . . . . . . . . . . . . . . . . . . . . II–82 CHAPTER 4 IMPLEMENTATION GUIDANCE FORMATERIAL CONDITION AND AGING MANAGEMENT

4.1 Preliminary MCA Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–85 4.1.1 Component Screening . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–85 4.1.2 Aging Degradation Mechanism Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–87 4.1.3 Estimation of Facility Remaining Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–87 4.1.4 Feasibility of Continued Operations and Extended Operations . . . . . . . . . . . . . . . . . . II–87 4.1.5 MCA Program Plan . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–88 4.2 Detailed MCA Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–88 iii 4.2.1 MCA Action Plan and Procedures . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–88 4.2.2 Final Identification of Life-Limiting Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–89 4.2.3 Detailed Aging Degradation Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–91 4.2.4 Determination of Facility Remaining Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–95 4.2.5 Feasibility of Continued Operations and Extended Operations . . . . . . . . . . . . . . . . . . II–98 4.3 Life Extension Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–99 4.4 Ongoing MCA Phase . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–99 4.4.1 Degradation Trending . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–100 4.4.2 Application of Life Extension Techniques . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–101 4.5 Specific Application of Graded Approach: MCA Adjunct Program . . . . . . . . . . . . . . . . . . . . II–101 Appendix lI–A Design Control . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–A–1 Appendix II–B Examples of Design Information . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–B–1 Appendix II–C Conduct of Walkdowns . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–1 Appendix II–D Content of Design Information Summaries . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–D–1 v FIGURES CHAPTER 1 Figure 1–1 Operational Configuration Management: Basic Relationships . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–2 Figure 1–2 Operational Configuration Management Program: Elements and Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–5 Figure 1–3 Operational Configuration Management: Implementation Considerations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–17 Figure I–A–1 Relationship of a DOE CM Program to the Life of a Facility . . . . . . . . . . . . . . . . . . I–A–5 Figure I–B–1 Design Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–4 Figure I–B–2 Assessments Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–14 Figure I–B–3 Remaining Lifetime and Desired Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . I–B–18

CHAPTER 2 Figure 2–1 Program Management Element: Overall CM Program Development andImplementation . . . . . . . . . . . . . . . . . . . . . II–2 Figure 2–2 Program Management Element: Management Actions for Program Planning . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–3 Figure 2–3 Program Management Element: Directives, Plans, and Procedure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–13 Figure 2–4 Design Requirements Element: Top-Level Development Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–16 Figure 2–5 Establishment of Design Requirements . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–18 Figure 2–6 Design Requirements Element: CM Equipment Database . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–23 Figure 2–7 Design Requirements Element: Assignment of System-Level Grades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–25 Figure 2–8 Design Requirements Program: Assignment of Component-Level Grades . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–27 Figure 2–9 Interfaces with the Fully Developed Design Requirements Element . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–30 Figure 2–10 Document Control Element: Top-Level Development Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–31 Figure 2–11 Document Control Program: Document Control Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–33 Figure 2–12 Document Control Program: Document Control and Tracking . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–36 Figure 2–13 Change Control Program: Top-Level Development Flowchart . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–40 Figure 2–14 Change Control Program: Change Control Functions . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–41 Figure 2–15 Change Control Program: Design Envelope Review Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–44 Figure 2–16 Assessments Program: Vertical Slice Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–49 Figure 2–17 Assessments Program: Horizontal Slice Methodology . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–51 Figure 2–18 Comparative Procedures Review . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–53 http://www.doe.gov/html/techstds/standard/std1023/s1023pt1.pdf vi CHAPTER 3 Figure 3–1 Design Reconstitution Program: Implementation Overview . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–62 Figure 3–2 Design Reconstitution Program: Sample Schedule . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–64 Figure 3–3 Design Reconstitution Program: Design Information Identif ication and Retrieval . . . . . . . . . . . . . . . . . . . . . . . . . II–68 Figure 3–4 Design Reconstitution Program: Evaluation of Extracted Design lnformation . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–72 Figure 3–5 Design Reconstitution Program: Discrepancy Resolution Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–75 CHAPTER 4

Figure 4–1 MCA Implementation Process . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–86 Figure 4–2 Final Identification of Life-Limiting Components . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–90 Figure 4–3 Detailed Aging Degradation Evaluations . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–93 Figure 4–4 Identification of Aging Degradation Mechanisms . . . . . . . . . . . . . . . . . . . . . . . . . . . II–94 Figure 4–5 Identification of Material Condition Measurements . . . . . . . . . . . . . . . . . . . . . . . . . . II–96 Figure 4–6 Final Determination of Facility Remaining Lifetime . . . . . . . . . . . . . . . . . . . . . . . . . . II–97 DOE–STD–1073–93 II-1 CHAPTER 2 IMPLEMENTATION GUIDANCE FOR OPERATIONAL CONFIGURATION MANAGEMENT This guidance is appropriate for high-hazard facilities expected to operate for an extended period. Since DOE facilities vary in hazard level and circumstances of operation, a graded approach to implementation should be adopted. 2.1 PROGRAM MANAGEMENT ELEMENT The program management element of a configuration management (CM) program coordinates program development and implementation and ensures overall program effectiveness. This element leads the development of the other CM program elements. Development of an effective CM program should be initiated promptly, where needed, to address known issues, to improve compliance with various DOE Orders, and to produce the benefits of improved safety, reduced errors, and increased efficiency. Configuration management program definition and development necessitates the establishment of local CM policy, philosophy, requirements, and strategies for development and implementation. Configuration management program development activities should be performed in a phased manner and should include milestones. Initially, development activities should focus on preparation of CM program directives and plans. The CM program criteria indicate that the CM program plan should be provided to DOE for review within 18 months of initiation of planning. Development of the CM program elements begins after CM program plan concurrence and should be completed within 2 to 3 years (for a large, complex facility). Program implementation should be initiated as each element is developed, with full implementation of the five CM program elements, including satisfactory post-implementation assessment, within 5 years. Adjunct programs such as design reconstitution could extend beyond 5 years. Once fully implemented, the CM program functions should be maintained throughout the life of the facility. Figure 2–1 provides an overview of the schedule for CM program development and implementation. In the following sections, program management is described by function in the general order of its Chronological development. The concepts and terminology, and equipment scope criteria functions are discussed under program planning. 2.1.1 PROGRAM PLANNING The CM program planning phase is of critical importance because it sets the direction and tone for future development and implementation activities. Configuration management policy development is a top- down activity, beginning with a general set of CM program criteria established at the site/division level. The CM directives should be issued initially at the highest level of management (site/division) and flow downward to the facility management level. In contrast with policy development, technical program planning starts at the facility level and flows up to the site/division level. The site/division CM program plan should be a consolidation of the facility CM program plans and should provide for implementation variations for different facilities based on hazard levels, operational constraints, and other variables. Figure 2–2 reflects the basic steps necessary for CM program planning.

Through review and concurrence with the CM program plan, DOE acknowledges that the plan defines the appropriate level of implementation, based upon the CM program criteria and the graded approach. Once reviewed, the plan serves as the basis for future assessments of program effectiveness and II–2 D O E –S T D –1073–93 II–3 D O E –S T D –1073–93 DOE–STD–1073–93 II-4 external audits. The program plan should be treated as a living document; it should be revised only as necessary to reflect changes In program implementation. Proposed revisions to the CM program plan should also be provided to DOE. 2.1.1.1 CM Policy Directives Effective program management begins with a clear understanding and statement of management's expectations. These expectations should be documented In a top-level management, site/division policy directive specific to the subject. Configuration management directives provide the structure and foundation for program development. These directives lead detailed program planning and program element development., Per program criterion 1.3.1.1.a, the site/division CM policy directive should accomplish the following objectives: convey top management support, define key roles and responsibilities, provide the equipment scope criteria for the CM program, and establish key concepts and terminology. The principles of operational configuration management need to be understood and accepted by facility personnel and integrated into their daily activities in order for the program to be effective. Management has to clearly show support for the CM program and communicate its commitment to every level of the organization for the effort to be successful. The CM policy directive should reflect top management's decision, commitment, and support for the development and implementation of the CM program at each facility. The CM policy directive should also define key roles and responsibilities for developing the CM program, Including the CM program plans. For example, it should formally empower a manager and organization to coordinate development of the CM program and clearly define their roles and responsibilities. If a central CM program organization is established, it should be involved in any changes to existing programs that could affect configuration management. The directive could also define the roles, responsibilities, and interfaces of other organizations and programs for development of the CM program plan. The CM policy directive should provide criteria for the scope of equipment to be included in the CM program. The scope criteria provide the foundation for identifying the specific structures, systems, and components (SSCs) and associated documents to be included in the program. This effort has a direct impact on program effectiveness, costs, and schedules. Therefore, establishing the technical scope of the program is crucial. As indicated by program criterion 1.3.1.2, SSCs with safety, environmental, and mission design requirements should be included in the CM program. Other SSCs should be included as an option; however, program cost and manageability should be considered.

Establishing the scope of equipment involves defining both the general categories of equipment and the specific criteria for its categorization. Input as to the existing categorization and recommended revisions, if needed, should be obtained from the design authority. Sites/divisions should also establish criteria and guidance specific to each category of design requirements. In fact, most sites/divisions have existing mission criteria that might be useful to this end. As an example, the mission criteria might be defined as including equipment whose failure could create a forced shutdown for 180 days or more. Also, facilities may have existing safety criteria, such as thresholds based on DOE 6430.1A, General Design Criteria (Section 1300-3.2). Sites/divisions should re-review existing criteria; provide any additional criteria, guidance, or clarifications; and formally establish the criteria within the CM program for design requirement categorization. Finally, the CM policy directive should establish CM program concepts, terminology, and definitions to ensure consistent usage and understanding, both within the program and among the various interfacing programs and organizations. Many of the concepts and terms currently used regarding configuration DOE–STD–1073–93 II-5 management derive from different programs and have various meanings depending on the context in which they are used. CM concepts, standard terminology, and standard definitions should be established in accordance with the definitions provided in the glossary provided in this Standard. These key concepts and terminology, supported by a functional model of the site/division CM program, ensure a consistent approach to facility CM program development. The site/division CM directive) should formally adopt the CM program objective, functional model, and the functions to be used by the facilities within the site/division. Directives are also useful for establishing other upper-level CM policy and immediate actions relative to program management functions such as database control and procedure development. Figure 2–2 shows the process of establishing an interim CM development team dedicated and committed to CM program development. This is the recommended approach because of the work and interface efforts involved. To ensure an understanding of the needs and capabilities of the organization as a whole, the team should be balanced with experienced personnel from different work areas. Where several facilities are under the jurisdiction of a single management and operations (M&O) contractor, the CM developmental team should have a mix of representatives from various facilities and groups within the organization. The CM development team should have a charter stipulating the activities consistent with its role in coordinating overall CM program development. Such activities could include developing a formal site/division CM directive for management approval early in the development process, working closely with each site/division manager to develop directives, and providing support to each facility during the development of the facility-level CM program plans. The details of program implementation should be a line management function, but a small core group is usually maintained to provide the program management functions necessary to ensure the proper implementation of the overall CM program. 2.1.1.2 Planning for Initial Assessments

Site/division managers should take the lead in planning and coordinating initial assessments. These assessments identify programmatic strengths and weaknesses for use as a basis for CM program planning and for immediate corrective actions. As a first step, facilities should be grouped according to mission, design, complexity, size, and other appropriate criteria. This action would allow for greater efficiency in the assessment process. For similar facilities with similar CM practices, an assessment of such practices for one site would be representative of them all. As a further example, several facilities might use a central or common approach to document control; single assessment in this programmatic area could be representative for several facilities. Second, the specific representative facilities, systems, programs, and topical areas should be selected for the initial assessments. Site/division managers should coordinate assessment activities such as the selection of assessment teams, training, and funding. Sites/divisions could elect to go beyond the minimum requirements in the initial assessments; the subjects of the other assessments would be based on a judgment of needs. The initial assessments are conducted in accordance with the criteria and guidance associated with the assessments element. When the representative assessments are complete and the results are available, this information should be shared with other facilities in the group (i.e., those found to be similar enough not to need separate initial assessments). Each facility in the group should factor these assessment results into its facility CM program planning. DOE may specify certain approaches to implementing a CM program on the basis of facility importance or budget considerations. For example, it may elect to use certain lead facilities as pilots and to have the others follow in a phased manner. Thus, lessons learned in the initial assessments, program planning, and program development for pilot facilities can be applied to the remaining facilities for DOE–STD–1073–93 II-6 greater cost-effectiveness. Wherever the pilot approach is pursued, priority attention to timely assessment of the change control functions is warranted. 2.1.1.3 Initiation of Immediate Corrective Actions and Interim Upgrade Actions The initial assessments should be conducted as planned and directed from the site/division level. If the initial assessments of programs and procedures reveal major weaknesses that warrant corrective action prior to the complete development and Implementation of the CM program, management should initiate immediate corrective actions to mitigate these weaknesses. These immediate measures may be replaced by Improved processes as the CM program matures. Priority attention should be given to identifying and stopping uncontrolled and unauthorized changes to the facility. If the initial assessments determine that uncontrolled changes are occurring, ft facility should initiate immediate corrective actions, such as implementing an Interim change control program. An effective approach to interim change control is lo require that nondesign organizations send all potential changes to the design engineering organization for evaluation. This action may have to remain in place until the change control element is fully implemented and design reconstitution efforts are complete.

An Interim upgrade of existing document control processes may also be necessary to ensure a proper interface with the change control program and to improve document accuracy or retrievability. Other areas that should receive priority attention, where major weaknesses are identified, are facility walkdowns to establish the physical facility configuration and a formal review of summary design information to establish an initial set of design requirements. Interim measures are vital to prevent the continuing loss of facility configuration, thereby invalidating other CM activities such as drawing and procedural updates. To the extent practical, interim measures should be taken within existing program and organizational structures. In some cases, it may be necessary to halt existing programs or processes temporarily until upgrade actions are completed. Interim measures should be replaced by improved programs and processes, implemented within normal line management structures, as the CM program matures. 2.1.1.4 Facility Program Plans After the site/division directive is issued, facilities should apply the directive and develop facility CM program plans. Configuration management program criterion 1.3.1.1.c identifies the topics that should be addressed by CM program plans. The facility should adopt equipment scope criteria consistent with the site/division policy directive. The facility should also review the site/division CM policy directive to determine whether the equipment scope criteria for SSC inclusion can be applied as is or need modification or clarification at the facility level. The CM program plan should identify the specific criteria for each design requirement type. The specific list of SSCs is not necessary at this stage of program development. Much of the CM program plan will focus on the objectives and description of the CM program activities needed to develop and implement each program element and function. A CM program plan format organized by program elements and functions is likely to facilitate efficient application and review. The development and implementation of each CM program element and function should be consistent with the program criteria and the CM directive from site/division management. As an example, under the program management element, the CM program plan should include descriptions of plans for establishing appropriate interfaces, including vendor control; plans for developing CM governing and implementing procedures, including associated training; and plans and criteria for CM equipment and document databases. DOE–STD–1073–93 II-7 The bases for the technical content of the CM program plan are (1) the findings of the initial assessments and (2) the application of the graded approach. For example, the preliminary estimate of a facility's remaining lifetime should be provided during the program planning phase and addressed in the program plan. Initial assessment results and immediate corrective actions in response to the initial assessments should be described in the facility CM program plan.

Completed activities should be described to demonstrate CM program functions that are implemented. For example, the CM program plan should describe the CM equipment scope criteria, the concepts and terminology adopted, and any initial CM training. To evaluate existing functions, the contractor should identity and analyze the existing program elements and functions, discuss the technical content of those procedures Implementing the CM functions using functional flowcharts, describe the assignments of responsibilities and authorities for configuration management, and define organizational and functional interfaces by which the CM program is integrated into a cohesive program. Then, the contractor should correlate the existing CM program elements and functions with the program criteria, describe how the existing program and procedural requirements satisfy these criteria, and describe how the existing program satisfies the CM objective. This analysis should build on the findings from the initial assessments, which use applicable horizontal assessment techniques. The results of this analysis should be documented in the CM program plan and should identify areas in which additional work is needed to rectify any discrepancies between the existing program and the CM program criteria discussed in Chapter 1. If DOE concurs that the combination of the existing CM program and identified improvements is adequate, this would constitute a program that meets the program criteria. The CM program plan should identify the organization that will have overall responsibility for developing and implementing the CM program. It should include current staffing and a summary of key personnel. It should also include estimates of staffing necessary to complete CM program development, along with a staffing plan to meet these needs. Finally, the program plan should identify key organizational interfaces and provide flowcharts, as appropriate, to show programmatic and organizational relationships and responsibilities. Once upgrade actions are identified, these should be prioritized both in relation to each other and in relation to other planned facilities activities. Schedules should be developed in accordance with these priorities. The CM program plan should provide schedules for implementation activities with defined deliverables for each milestone. Cost estimates should be identified for each activity or deliverable. The plan should also discuss the responsibilities and methods related to the management function of monitoring progress in the development and implementation of the CM program. Questions such as the following should be addressed: • How will this monitoring be accomplished? • What parameters will be used to gauge progress? • How will problems be identified? • What levels of facility management will receive periodic progress and problem reports? • How will decisions to make midcourse adjustments to the program be made? • Who in the contractors organization will be responsible and accountable for the progress achieved? 2.1.1.5 Site/Division CM Program Plans Facility plans should be consolidated into a site/division CM program plan. This upper-tier program plan is intended to present both the individual facility CM program plans and additional summary information such as summary schedules and costs for the site/division. During compilation activities, the upper-level organization could ensure that the facility program plans are consistent with expectations. In some cases, individual facility program plans might not be needed where the facility

DOE–STD–1073–93 II-8 CM program can be fully described by an upper-tier program plan. The upper-tier program plan could be developed as the general program plan with additional descriptions and clarifications as to how it is applied to the individual facilities. In some cases, certain program elements or functions serve multiple facilities. For example, document control could be established centrally for multiple facilities. In such a case, the central document control measures would not have to be described in each facility's program plan; they could be described once in the upper-tier program plan. 2.1.2 INTERFACES Interface Control. Starting during development of the CM directives and continuing through program planning and development, the CM program should identify and define the key programmatic and organizational interfaces. Defining effective and efficient interfaces, both internal and external, Is critical to the workability of a CM program. Program interfaces are those relationships established to ensure that identification and integration of the key facility programs are such as to effectively support and maintain consistency among the design requirements, documents, and hardware. Program interfaces include those internal to the CM program, such as the interface between document control and change control, as well as those between the CM program and programs such as design control, project control (DOE 4700.1), surveillance testing, maintenance, and any program or mechanism involved in defining, evaluating, and documenting changes. As the fundamental approach to implementing the CM program is to identify, upgrade, and integrate these existing programs, the program management element should clearly identify these programmatic interfaces. Roles, responsibilities, and relationships among the program elements and functions should be defined and documented. Relationships to other programs that interface with the CM program should also be clearly defined and documented. The CM program involves numerous interfaces among organizations. Organizational interfaces are those relationships established to ensure that key functional organizations (such as design engineering, operations, and maintenance) are aware of the roles, responsibilities, and interactions necessary for adherence to the CM program. Organizational interfaces can be internal interfaces within the facility, she, or corporate organization, as well as external interfaces with organizations outside the contractors corporate structure. The program management element should entail identifying, formalizing, and monitoring the organizational interfaces that can affect CM functions. Organizations and key personnel involved in developing, implementing, and managing CM program activities should be identified. Management expectations regarding the roles, responsibilities, and authorities of the organizations and key personnel should be clearly defined and documented. Contractors might find it worthwhile to designate CM program coordinators in each major organizational unit to ensure adequate interfaces. External interfaces might need to be implemented by contractor interface agreements or formal contracts, as appropriate.

Often, the weakest parts of CM program implementation are the interfaces between the program elements and the organizations implementing these elements. The accuracy and completeness of configuration information transferred within and across organizational and functional boundaries is the focus of the CM program, in that the transferred information establishes and maintains the CM program basic relationships. Since information needs to flow among interfacing programs and interfacing organizations (e.g., change control functions should provide current information to support document control functions), flowcharts are the recommended tool for defining and analyzing program and organizational interfaces. Flowcharts are particularly effective in identifying program interface points and thus in exposing weaknesses in program integration. Having learned this lesson, some organizations now use flowcharts as part of the development of every procedure. Procedure flowcharts should be functional, not administrative (i.e., showing only the handling of forms and documents, not necessarily the functions being performed along the way). DOE–STD–1073–93 II-9 Vendor Control. Most DOE facilities use vendors or outside contractors for the performance of selected technical work such as design change package development, safety evaluations, specialized analyses, and construction. The greater the use of vendors, the greater the need for formal control. Vendors also supply facility equipment and materials. Technical vendor control is the process used to ensure that Important vendor activities and information support the facility's CM program. The program management element should provide policy and procedures to ensure that important vendor activities and information are consistent with the CM program. The CM program should provide for the review and approval of vendor procedures prior to the commencement of work or impose the use of facility procedures in all work performed at the facility. In addition, acceptance criteria should be established by the facility to define when vendor work has been completed satisfactorily and is ready for turnover to the facility. After turnover, vendor information used by facility personnel should be incorporated directly into the facility document control program and kept current. The facility should have sufficient resources and talent to judge the quality of work and ensure adequate control over vendor activities. Vendor control measures might need to be implemented by contractor interface agreements and formal contracts, as appropriate. Special problems can arise regarding the control and use of vendor technical information such as vendor manuals and notices. To simplify document turnover and control, facility management could choose to review vendor technical information and excerpt relevant portions for direct inclusion into facility procedures before that information is used by facility personnel. After turnover, vendor Information used by facility personnel should be incorporated directly into the facility document control program and kept current. 2.1.3 DATABASES

The extent and interrelationships of CM-related information necessitate the effective development of information systems such as databases, logs, indexes and cross-reference tracking systems, and change status tracking systems. Objectives in the design of such systems include minimizing the potential for conflicting versions of the same information in more than one system, maximizing the flexibility and speed of information searches, establishing clear accountabilities for generating information to be tracked and for tracking the information, ensuring that the information is, accessible to those who need it, preventing unauthorized changes to the information, establishing a single authority for any given information, and minimizing duplicated and otherwise redundant labor. Well coordinated and controlled databases become primary focal points of effective CM programs. There are two general types of CM databases that need to be established and controlled: equipment databases and document databases. Equipment databases contain and correlate information about the SSCs within the CM program, while document databases convey information about the documents, including their status. Both databases provide information useful for the evaluation of changes. Properly designed and well-managed equipment and document databases are essential (configuration management tools; they support many functions important to safe facility operation. Such databases are included in the scope of the CM program because they contain and correlate vital configuration management information. Because of the importance of these databases to the CM program, the program management element should define policies and procedures for establishing and controlling them. A site/division CM directive could be used to define general policy and criteria for CM equipment and document databases. The CM program plans should discuss the steps necessary for developing (or validating) and controlling these databases. DOE–STD–1073–93 II-10 The program management element should identify the general contents of the two types of databases. Their format, content, and capabilities should be adapted based on the identified needs and intended uses. They should also be sized considering future needs by allowing for significant expansion of the number of data fields and types of information. The program management element should also identify controls for database development, implementation, and revision, especially those necessary to establish and maintain the quality of information. The steps to develop effective CM databases should include the identification of those databases that contain CM-related information, the consolidation of related information into a few key databases, and the establishment of control mechanisms to ensure data quality and accuracy. An initial study should be conducted to identify existing equipment and document databases, their contents and uses, responsible organizations, and locations. The initial study should reflect the results of, and may be performed in conjunction with, other initial assessments.

On the basis of the initial study, an action plan should be developed to consolidate or eliminate as many of these databases as possible. A typical facility has many separate databases containing similar information, with minimal interfacing or administrative controls. As a result, these databases develop errors and inconsistencies, which contribute to configuration problems. A desirable approach is to have all facility information computerized, residing in a master database, and accessible from most locations within the facility. However, the time and investment for a new consolidated database should be weighed against the need to establish a few well controlled existing databases. In some cases, especially where databases are well coordinated and controlled, few changes are expected. In other cases, where many databases are in use, some containing offering data because they have not been coordinated or updated, more changes are appropriate. Key conclusions, milestones, and schedules from the database study and action plan should be reflected in the facility CM program plans. Procedures should be developed for control of the quality of information within these databases (for example, procedures governing approvals, validation and verification of information, access and security, and revisions), and there should be methods for retrieval of that information consistent with the needs of the users. Special controls should be Instituted to ensure that any database used for Configuration management purposes will be protected to prevent inadvertent or unauthorized changes of the data. To be effective, the data collection function would have to be integrated into each CM - related process and specified in written procedures. Collection of the necessary data should be facilitated and standardized, and should be consistent with the normal flow of information. Data collection should be supported by forms that are designed to prompt the owner or user for the necessary information in a format that enables ready identification of the specific fields as well as verification that the necessary information is present, coordinated, and approved. Equipment databases should specify equipment classifications, contain or reference equipment design requirements, and cross-reference supporting CM information. These databases should provide current information on facility SSCs and associated documents within the CM program, with emphasis on design documents. An approach that has proven successful elsewhere is the development of a computerized CM master equipment database that includes every facility component. Each component is assigned a unique identifier based on system, component type, and component function before it is included in the database. This database can serve as the primary source of descriptive, testing, and operational data on hardware and instrumentation. Equipment databases are discussed further in the implementation guidance for the design requirements program element. Document databases provide basic information about the documents in the CM program. Both document and equipment databases include some relational information that links SSCs to documents. Document databases provide more extensive document-specific information than equipment databases, including information on change status and related documents (such as change notices and physical DOE–STD–1073–93 II-11

changes in progress) and pending changes. They also provide the capability to relate documents based on types of documents, specific SSCs, groups of SSCs, technical topics, and other useful cross- referencing topics. Document databases are discussed further in the implementation guidance for the document control element. 2.1.4 CONFIGURATION MANAGEMENT PROCEDURES This section discusses those vehicles or mechanisms that support CM program plans and directives by communicating increasing levels of detail on program direction and guidance. The program planning function provides top-level direction through CM policy directives and the CM program plan. The procedures function provides CM program direction through CM action plans, CM governing procedures and implementing procedures, and associated training. 2.1.4.1 Action Plans Program management involves careful planning and effective controls to ensure that the effort is credible, timely, and cost-effective. Starting from the program plan, facilities should prepare action plans to provide further detail, as needed, on those program plan topics related to program development and implementation. These plans should serve as an important vehicle to get the various organizations and personnel at the facility to understand, accept, and support CM development efforts. They are the primary management tool for coordinating development and implementation activities; they should integrate and focus these activities to ensure that they can be implemented successfully, managed effectively, and monitored for progress. Configuration management action plans should be established promptly following DOE review of the CM program plan and before program development commences. Action plans should provide detailed direction in the areas of task descriptions, methods, assignments, schedules, and budgets. They do not need to expound on the basis of the program. Action plans should be consistent with the program plan but expand on implementation particulars. Regarding assignments, for example, the program plan might identify divisions or departments responsible for development activities, while the action plan would identify specific responsible individuals. Regarding tasks and methods, where the program plan might, for example, state that the owners of each change control process will be identified and that they will evaluate and upgrade their processes, the action plan would identify more specific methods for process evaluation and upgrade, such as establishment of process improvement teams, interviews with process users, preparation of flowcharts, interactive sessions with trained facilitators, pilot implementation, and review by an executive sponsor and process improvement specialist. With regard to schedules and budgets, the program plan might, for example, establish a 2-year milestone for development and upgrade of the equipment database, while the action plan might divide the activity into 15 identifiable tasks, each with a task description, deliverables, milestones, a budget, and assigned personnel. Depending on program size and complexity, action plans might be prepared for each CM program element, or even for the more complex individual functions, such as databases or walkdowns.

Action plans should provide more detail than program plans on process and quality controls, interface control, communication methods, and progress-monitoring methods. They should identify how CM development activities and results will be communicated throughout the organization, such as through training, seminars, newsletters, and interdisciplinary teams. Action plans should also establish methods for measuring and controlling progress, including objective parameters against which progress can be measured, management accountabilities, regular internal status reports, and periodic management reviews to monitor progress and resolve problems in a timely manner. While the program plan is viewed as a commitment document and is revised only as needed, action plans should be revised periodically until implementation is complete to keep them useful and authoritative. DOE–STD–1073–93 II-12 2.1.4.2 Governing Procedures Configuration management governing procedures should be developed after the CM program plan has been reviewed by DOE and should support the action plan. Governing procedures should be developed for each CM program element and adjunct program and should address each program element function and its relationships. The CM program plan should identify the CM governing procedures that will be developed. The CM governing procedures provide the framework for integrating the implementation of the CM program elements and functions. They should indicate how the CM functions are carried out in the various implementing procedures, and thus, how those functions conform with the CM program plan. The governing procedures describe how and when the CM program element is invoked and generally how its functions are executed with reference to the detailed implementing procedures. Once the CM governing procedures are in place, the CM program should be able to accomplish its objectives and functions by adhering to these procedures and maintaining and updating them as needed. The primary goal of the governing procedures is to provide overall coordination and integration of the various implementing procedures and implementing organizations. As an example, a governing procedure on document control would reference, describe, and show interfaces among the implementing procedures for matters such as the drawing change process, the field change notice, the design change notice, record retention, document distribution, the identification of key words, and document tracking. Similarly, the change control governing procedure would identify implementing procedures for approved change mechanisms and for such activities as the conduct of technical reviews and the approval, implementation, and documentation of changes. The CM governing procedures may also provide information useful for ensuring consistency in implementation, such as the following: statements of purpose and applicability, definitions, top-level CM program requirements (consistent with the CM program plan), key organizational interfaces, top-level roles and responsibilities, key programmatic interfaces, and functional flowcharts showing relationships among implementing procedures and among organizations.

The governing procedure for the program management element should ensure that the overall CM program is complete, coordinated, and integrated. It should identify the implementing procedures for the program element functions and invoke the other CM program governing procedures. It could also address the overall program model and functions, program scope, program interfaces, and organizational interfaces and responsibilities. Much of this information will have been established by the CM directives and plans; the overall governing procedure provides the top-level procedure for ongoing implementation of the fully-established CM program. Governing procedures are, in effect, an umbrella document for the implementation process. They can be graphical in nature and take the form of functional flowcharts. Governing procedures in the form of functional flowcharts are also helpful in identifying gaps in procedural links and conflicts between specific implementing procedures. They can also identify decision points and places where quality or management reviews are appropriate. These procedures can also be helpful for configuration management orientation and training. Figure 2–3 shows the development of the governing procedures in relation to the development of CM policy, plans, and implementing procedures. The governing procedures provide the link between the CM action plan and the implementing procedures. DOE–STD–1073–93 II-13 DOE–STD–1073–93 II-14 2.1.4.3 Implementing Procedures The program management element should also ensure that appropriate implementing procedures are prepared for each CM program function. In contrast with governing procedures, the implementing procedures provide the detailed instructions for carrying out CM program functions. Implementing procedures are developed for individual program elements as needed. The size of the operating organization influences the need to proceduralize CM activities; the larger the organization and the more numerous the interfaces, the greater the need for procedural controls. During the initial assessments and program planning, the organization's many existing procedures implementing CM functions will be reviewed to determine If upgrades and enhancement!; are necessary to satisfy the CM program criteria described in Chapter 1. Enhancement and integration of existing implementing procedures within their established organizational structure Is the preferred approach to CM program development and Implementation. It may be necessary or desirable, however, to temporarily consolidate control of implementing procedures in a central CM development organization for purposes of upgrade and integration. During this consolidation phase, it may even be desirable to use the governing procedures to define implementation methods, and later move the implementation methods and requirements to the implementing procedures. On completion of implementing procedure upgrades, the revised implementing procedures would be redistributed to the appropriate implementing organization for ongoing implementation. 2.1.4.4 Configuration Management Training

As policy, plans, and procedures are established, associated training should be provided to communicate expectations and to ensure effective implementation. In addition to standardizing terminology and establishing an integrated system of procedures regarding CM activities, a formal training program in configuration management can be very Important in property orienting facility personnel. The program management element should establish and oversee CM program training activities, including (1) initial awareness or orientation training, (2) follow-up training on development and implementation of the CM program elements and functions, and (3) subsequent refresher training as needed. As defined in the program criteria, training should be provided on CM concepts, terminology, definitions, and procedures. Training should be started early in the development of a CM program to acquaint users with the new concepts, to ensure a common understanding of the objectives, and to communicate responsibilities for implementing the program (i.e., CM-awareness training). Organizational culture change regarding configuration management is a fundamental part of successful CM program implementation. For example, facility personnel should be able to identify appropriate change mechanisms and always use them. Training, supplemented by clear and documented expectations, and followed up with feedback and coaching, is an effective tool for promoting the culture changes that are needed. An effective approach to CM training is to provide 1 or 2 days of initial awareness training and then follow-up training as CM procedures are developed and implemented. The initial training should be conducted as early in the CM program development process as practicable, preferably after the site/division CM directive is issued. This training should (1) provide an overview comprising a description of the need, purpose, and management commitment and a definition of the CM program and Its program elements, (2) explain the site/division strategy for developing and implementing the CM program, and (3) identify any interim measures to be adopted until CM program development is complete. Follow-up training should be conducted as the governing and implementing procedures are written, approved, and issued. The objectives would be to discuss and clarify individual roles, responsibilities, DOE–STD–1073–93 II-15 interfaces, and key activities necessary to fully implement the CM program. The organizational and functional CM flowcharts used in the CM program plan should be retained and used in the training process. Training based on these charts may be started as soon as the concepts have been agreed on and approved by facility management. Refresher training would be provided periodically (e.g., once a year) for approximately 4 to 8 hours to reinforce the principles of configuration management, to review implemented CM methods, and to advise personnel on any changes In CM tools or practices. 2.1.5 SPECIFIC APPLICATION OF GRADED APPROACH: PROGRAM MANAGEMENT ELEMENT The size and complexity of the facility indirectly affects the number of SSCs included in the CM program. For example, at a small facility, such as a nuclear hot cell facility, there are not many SSCs. Accordingly, the number of SSCs that can be included in the CM program will be small.

The scope of the SSCs included in the CM program will affect the level of effort involved in every CM program element and function. Facility management could (1) include all facility SSCs within the CM program, (2) limit the scope to some minimum SSCs, or (3) choose a scope between these extremes. At some facilities, it might be appropriate to limit the SSCs to those that provide personnel safety protection. At others, such as nuclear waste tank farms, it might be appropriate to include those SSCs that protect the environment. At other facilities, such as weapons facilities or alternate-energy development facilities, it might be important to include the mission SSCs. Because the magnitude of the CM program is so strongly influenced by the SSCs included in it, contractor management might find it worthwhile to reevaluate the current classifications of systems within the facilities. Some SSCs that have traditionally been classified as safety-related might not be essential for safety. For example, many nuclear facilities have diesel generators that can provide backup electric power in the event of a loss of normal power. Often, these generators are considered safety-related because they have traditionally been classified that way. In some cases, safety is assured regardless of the performance of the diesel generator. If the accident analysis can demonstrate that an interruption of AC power for a significant period does not lead to unacceptable safety consequences, and normal electric power is likely to be restored within that period, the diesel generator is most likely not essential for safety. In such cases, classification of the diesel generator, could be downgraded. 2.2 DESIGN REQUIREMENTS ELEMENT As with other CM program elements, much more effort is necessary for initial establishment of this program element than for its maintenance. For many facilities, establishing a complete and accurate set of design requirements can involve more time and resources than any other CM program element. However, this program element is essential because the design requirements are the foundation from which the CM program basic relationships are maintained. The top-level development flowchart for the design requirements program element is presented in Figure 2–4. Existing design requirements are reviewed to establish the Best Available Design Requirements. As new or revised design requirements are established, this information is fed into the Best Available Design Requirements. Design requirements are correlated with SSCs through the CM equipment database. With the design requirements established, system and component grading can be accomplished. The two key inputs are the equipment scope criteria (from the program management element) and the list of known SSCs. System grading establishes the scope of systems within the CM program and assigns system grades according to the significance of the associated design DOE–STD–1073–93 II-16 DOE–STD–1073–93 II-17 requirements. Component grading continues this SSC grading process at the component level. The component-level grading activity also establish the system boundaries and refines the assignment of components to systems. The SSC grades are fed into the CM equipment database. 2.2.1 ESTABLISHMENT OF DESIGN REQUIREMENTS AND DESIGN BASIS The top-level flowchart for establishment of the design requirements is presented in Figure 2–5. This process involves the review of existing design requirements, as well as the addition of new and revised design requirements through design reconstitution and the ongoing design process.

Configuration management program criterion 1.3.2.1 states that the design requirements and design basis should be formally established, documents, and maintained. The CM program should identify the various processes and procedures used to establish the design requirements and design basis. For new facilities and physical changes to existing facilities, the program should ensure that procedures are in place that adequately establish the associated design requirements and their design basis, and that document them in a form suitable for use in the CM program. Documentation of the design requirements includes their correlation with associated SSCs and their categorization by type (i.e., safety, environmental, mission, and other). Documentation of the design basis involves its correlation with associated design requirements. Once the design requirements and design basis are established and documented, the CM program should ensure that processes and procedures are in place to maintain them so that they are complete and accurate. 2.2.1.1 Interim Measures for Design Requirements Element During the development of the CM program plan, the effectiveness of existing programs and procedures is assessed. These initial assessments may Identify cases in which the design requirements and basis were not fully documented, not accurate, or not complete. The following are examples of interim measures that may be needed until development of the design requirements program element is complete: • Additional controls to ensure that newly generated design requirements and design basis are maintained and available • Additional procedural guidance on sources of design requirements to ensure that an adequate design envelope review is performed for potential facility changes •� Additional procedural guidance to ensure that designers thoroughly research the existing design basis before issuing new designs • Additional procedural guidance to ensure that the design process produces a complete set of design requirements and design basis for each new design or design change (See Appendix lI–A for more information on various design controls.) • Actions to prevent the destruction or disposal of source documents containing design requirements and design basis information • Actions and controls to ensure that the knowledge of experienced engineering and operations personnel regarding facility design requirements and design basis is not lost when they transfer or retire; this includes actions to collect and record design information from personnel who recently transferred, retired, or are near retirement Yes DOE–STD–1073–93 II-18 DOE–STD–1073–93 II-19 2.2.1.2 Design and Construction Turnover The operational CM program should establish formal criteria for the design and construction turnover of new facilities or new modifications. When an effective interface can be established early in the design process, it is more likely that the needed design products will be provided and turnover can be successful. To ensure effective turnover, the operational CM program should (1) specify the format and content of design basis and design output documents at design inception to ensure that they will be compatible with the CM program needs, (2) periodically monitor the preparation of design basis and design output documents, and (3) provide review and approval of the format and content of final design basis and final design output documents and accept responsibility for their configuration management at turnover.

To ensure a format suitable for use in the operational CM program, the design requirements and design basis should be differentiated, the design requirements should be correlated with the associated SSCs, the design basis should be correlated with the design requirements, the design requirements should be categorized (i.e., safety, environmental, mission, or other), and accurate as-built drawings should be provided. Timely recognition of these interfaces and appropriate coordination will save time and avoid additional costs after turnover. Although it is highly desirable, it is not always possible for the operational CM program to be involved with the designer/constructor during the design and construction phases. For example, a major new facility might be ordered and designed before final assignment of the M&O contractor. In such a case, the designer should be responsible for ensuring that the operational CM program has the necessary turnover information in a usable form. If the operational CM program is not involved in the design/construction process or if it fails to provide an effective interface, the operational CM program should identify and implement any necessary steps to recover missing information. As an example, the output of the DOE 4700.1 process, which controls the design for new acquisitions and major physical changes, becomes the input to the operational CM program. If the output is in a form compatible with the needs of the operational CM program, the turnover is acceptable and the operational CM program can maintain the design requirements and their design basis. 2.2.1.3 Technical Management Review of Existing Design Information With regard to the completeness and accuracy of existing design requirements and design basis, there are many possible cases: 1. Facility design requirements and design basis are fully established, documented in an integrated manner, and maintained so that they are complete and accurate throughout the facility lifetime. 2. Facility design requirements and design basis are established and documented in various and diverse design documents, and they are believed to be generally complete and accurate. 3. Facility design requirements and design basis are established and documented in various and diverse design documents, but their completeness and accuracy cannot be demonstrated. Case 1 is the desired objective of the CM program. Variations such as the above cases are expected throughout the DOE complex because of such factors as the time frame of initial facility design and construction, the CM practices during initial design and construction, the CM practices during the facility operating life-cycle, and any design reconstitution efforts completed or in process. DOE–STD–1073–93 II-20 As discussed in program criterion 1.3.2.1.b, a technical management review should be performed to determine the adequacy of the facility design requirements and design basis. Judgments of adequacy should be based on completeness, accuracy, and full documentation. The conclusions and the basis for the conclusions regarding the adequacy of the facility design requirements and design basis should be documented in the facility CM program plan. If the conclusion is that the design requirements and their design basis are not fully documented, not complete, or not accurate, then they should be reconstituted to the extent called for by the design reconstitution adjunct program.

This technical management review should identify the actions necessary to evaluate the current status of facility design requirements and design basis. It should consider the results of applicable assessments, especially the initial CM assessments. The completeness and accuracy of the facility design requirements and basis is one of the most significant areas to be evaluated during the initial assessments. By correlating the design basis with the design requirements and the design requirements with the physical configuration and facility documentation, the vertical slice assessment can provide unique insights into the completeness and accuracy of existing design requirements and basis, as well as into the effectiveness of past and present CM practices. If the initial assessments support a definitive conclusion regarding the adequacy of the facility design requirement and design basis, no further activities may be necessary other than a review of the assessment results by technical management. However, if the initial assessments do not support a definitive conclusion, the management review should identify additional actions to supplement the findings of the initial assessments. The technical management review should include technical managers having broad design backgrounds and experience and representing the various design disciplines. Several different approaches to this review are possible. Whichever approach or combination of approaches is chosen, it should focus on whether any design information is missing. The technical management review process may include the following methods of assessing completeness: • Comparisons with industry codes and standards that identify expected design information • Comparisons of like design requirements for comparable components • Comparisons of like design basis for comparable design requirements • Review of design information to identify SSCs with missing or incomplete information • Review of open items and discrepancies that have not been resolved • Review by independent, external, technical experts In conjunction with the approaches listed above, a template approach may be used. A generic template is prepared to identify the types of design requirements and design basis typical for a given SSC type. The template is comprehensive and includes both the expected and possible design requirements and design basis. The design requirements and design basis would be compared with the template to identify missing requirements and design basis. For example, a template for piping might check for design requirements such as basic flow diagrams, layout and arrangement diagrams, isometric diagrams, support detail, material specification, testing requirements, and many other items. For the design basis, the template for piping might check for pipe sizing/flow analysis, minimum wall thickness evaluations, corrosion/erosion allowances, American Society of Mechanical Engineers (ASME) code conformance, DOE commitments, system interface input requirements, design procedure documentation, and many other items. Other examples of design requirement and design basis information that could be appropriate for the templates are presented in Appendix II–B. DOE–STD–1073–93 II-21 Inaccurate design requirements and design basis can be identified by discovering conflicting documentation, a conflicting physical configuration, or errors (in calculation, for example) in the design basis. To assess accuracy, the management review could employ some combination of the following methods:

• Checks of reasonableness by competent design personnel • Checks to determine whether the design requirements apply to current physical configuration • Reperformance of critical calculations and analysis independently or with different methods The facility design requirements should be documented in a retrievable, user-friendly manner. The relevant design information should be identified by system and an index of design documents should be provided. To determine whether the design is fully documented, the management review should consider whether: the design information is clearly identified; the design requirements are differentiated from the design basis; safety, environmental, and mission design requirements are differentiated from other types of design requirements; and the design documentation is indexed, integrated, and usable. Objectives for the documentation of design information are provided in Chapter 3. If design reconstitution is warranted, the management review should develop recommendations as to the extent of design reconstitution needed and the associated priority. 2.2.1.4 System Design Descriptions The CM program and engineering management may decide to prepare system design descriptions (SDDs) to collect and summarize existing design requirements for each system and topical area. The SDDs would help facility personnel understand system functions and requirements. They would include system drawings and a system description, as well as descriptions of functional process requirements, system and component design requirements, system interfaces and interlocks, setpoints, and design requirements related to operations, maintenance, and testing. The SDDs could be predecessors of the design information summaries (DISs) prepared by the DR adjunct program. They should be prepared in a format convenient for adoption into the DISs that will be developed later. DOE Standard NE F 1-2T, Preparation of Plant and System Design Description Documents, provides information on documenting design requirements. 2.2.1.5 Configuration Management Equipment Database The CM equipment database should be established to cross-reference the CM program SSCs with their design requirements, design basis, and associated documents. This database is the primary information source for design requirements. It should use the Best Available Design Information to fill the database fields. This Best Available Design Information comes from three basic sources: (1) existing design information, (2) new or revised design information, and (3) reconstituted design information. Computer databases can effectively and efficiently support the design requirements element, serve many users, and advance configuration management. Computer database development should maintain focus on achieving the associated CM program elements and functions. The program management element provides general direction, including general contents, for CM databases. Given the extent of the contents, relational databases will likely be most effective, as they can relate records in one file to records in many other files. For example, the equipment database should be able to identify the SSCs involved in the fire protection program. DOE–STD–1073–93 II-22 The CM equipment database should contain and correlate the following information:

• System designators • Component designators • Component descriptive information such as type, manufacturer, model, and size • Design requirement types applicable • SSC grade (based on the most Important design requirement applicable) • Design requirements or, at a minimum, references to them • Design basis references • Design topical area references (e.g., seismic, environmental qualification, fire protection) • Facility document references (e.g., drawings, procedures, Safety Analysis Report (SAR) and Technical Safety Requirement (TSR) sections) • Other desired system and component information A simplified sample format for a basic CM equipment database is provided as Figure 2–6. The actual format, contents, and capabilities of an organization's CM equipment database will depend greatly on the identified needs and intended uses. As part of the establishment of design requirements, each SSC within the CM program should be assigned a unique identifier, if one has not already been assigned. Unique identifiers that incorporate system designators, component type, and numbers (e.g., SW-MOV-91) are more useful than strictly numeric identifiers (e.g., 1357111317). The component identifiers should correspond to the labeling of equipment for physical configuration. Unique identifiers and equipment labels are important for helping maintain the CM program basic relationships and for supporting equipment operations. Operational aspects of equipment designation and labeling are discussed in DOE 5480.19, Conduct of Operations Requirements for DOE Facilities. A database owner should be assigned, with roles and responsibilities established. As most of the information is design information, the design authority is a likely choice. As such, the design authority would be the focal point for resolving discrepancies and updating the database. Other organizations should use the CM equipment database as their primary source for SSC design information. Information necessary to complete certain facility document reference fields will likely come from personnel coordinating implementation of the document control program element. The purpose of these facility document references is to support identification of the affected documents when design changes are made. The design authority can be expected to complete the document references that relate to design information -- either design requirements or design basis. However, other organizations will be assigned ownership of other documents important to configuration management (e.g., as-built drawings; operations, maintenance, and testing procedures; SARs and TSRS). A central document control organization may support completion of the affected database fields by coordinating database input for nondesign documents and ensuring the ongoing integrity of that information. 2.2.1.6 Design Reconstitution Interface The DR adjunct program, if pursued, contributes to the Best Available Design Information. The verified and validated results of these efforts should be entered into the CM equipment database. Further, these results should be reviewed for their impact on system and component grading while they are being entered into the database. If design reconstitution is necessary, certain DR program actions, such as the formal review of on-hand design documents, should be considered for prompt initiation to support development of the design requirements element. For major design changes, it may also be desirable to accelerate design reconstitution on selected systems and components. Implementation guidance for design reconstitution is provided in Chapter 3.

D O E -S T D -1073-93 II-23 SSC SSC Descriptive Safety Environmental Mission Other SSC Design Design Seismic EQ Fire System Component Information Design Design Design Design Grade Rqmts. Basis Program Program Protection Rqmts. Rqmts. Rqmts. Rqmts. References References Program System 1 Comp. 1 • • • • 7 7 7 7 S Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 7 7 System 1 Comp. 2 • • • • 7 7 E Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 System 1 Comp. 3 • • • • 7 7 M Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 • • • • • • 7 S Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 7 • • • • • • 7 E Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• • • • • • • 7 7 M Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• System 1 Comp. M • • • • 7 O Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• System 2 Comp. 1 • • • • 7 7 E Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 7 7 System 2 Comp. 2 • • • • 7 7 7 S Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 7 7 System 2 Comp. 3 • • • • 7 O Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 7 7 • • • • • • 7 E Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• • • • • • • 7 7 M Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• • • • • • • 7 S Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 System 2 Comp. M • • • • 7 7 S Ref1, Ref2, •,•,• Ref1, Ref2, •,•,• 7 • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • • Figure 2–6. Design Requirements Element: CM Equipment Database Ec-ll SSC System SSC Component Descriptive Safety Mission Other SSC Design Design Seismic Information Design Design Design Design Grade Rqmts. Basis Program Rqmts. Rqmts. Rqmts. Ramts. References References Figure 2-6. Design Requirements Element: CM Equipment Database EQ Program Fire Protection Program €6-€Z0T-G1LS-40d DOE–STD–1073–93 II-24 2.2.2 ASSIGNMENT OF SSC GRADES The grading of SSCs can be performed efficiently by separating system and component grading. The systems are graded first the components to systems and graded next. This approach to grading calls for increasing levels of design requirements knowledge as the grading proceeds to the component level. For example, it might be obvious that a given system is related to safety, but less obvious that a given component within that system has a safety function. 2.2.2.1 System-Level Grading Facility structures may be categorized as either systems or components, whichever makes the most sense for the facility. The facility may choose to address structures collectively as a single overall system and address individual structures as components. Alternatively, individual structures may be associated with the systems they house and support. Similarly, computers and software important to facility operation should be evaluated as either systems or components, as appropriate. A flowchart showing the basic steps for system-level grading is presented as Figure 2–7. The initial step of system grading is to identify the facility systems. System designations already exist at most facilities. If such designations do not exist, the components that accomplish the same basic facility functions and processes should be grouped into systems.

The second step is to identify the types of design requirements that apply to each system according to the best information on the design requirements available. (The specific criteria for each requirement type will have been established during program planning.) For the Initial system grading, experienced personnel with key design documents on hand are capable of applying their design knowledge to make this determination quickly and accurately. Such summary design references include the facility SAR, the TSR, SDDs, fire protection analyses, criticality evaluations, and any other readily available general and summary design documents deemed appropriate by experienced personnel. Later, as design requirements are formally reconstituted, the Best Available Design Information might indicate a need to refine these determinations. The next step is to assign a system grade according to the types of design requirements that apply to each system. The grade is based on the most important category of design requirements that applies. For example, if a system has safety design requirements, it is a safety system. If it has mission design requirements and neither safety nor environmental requirements, it is a mission system. For example, a facility life-limiting component, as identified by the material condition and aging (MCA) adjunct program, would be graded as mission if no higher grade applied. 2.2.2.2 SSC Inclusion In Configuration Management Program Finally, the facility CM program equipment scope criteria are applied to determine which systems will be included in the CM program. (These criteria should have been established by the program management element equipment scope criteria function and documented in policy directives and the CM program plan.) For example, the equipment scope criteria may be such that only safety, environmental, and mission SSCs are within scope, in which case the optional systems are out of scope and no further action is necessary for these systems. A facility may elect to include none, some, or all of the optional systems. As another example, if only the safety SSCs were within the scope, the other systems would not be included in the CM program. New information relevant to system grading will be identified periodically in ongoing CM program development and implementation as well as normal design and operations activities. This includes the preparation of new designs. For example, the facility might add a new system that needs grading. DOE–STD–1073–93 II-25 DOE–STD–1073–93 II-26 Further, the DR adjunct program might uncover facility design requirements that affect system grading. The impact on system grading should be considered for any newly found information. While system grading is generally a one-time activity, it is reviewed and revised, as necessary, when new information becomes available. 2.2.2.3 Component-Level Grading The scope of component grading is much greater than that of system grading because of the much greater number of components. However, the grading process is analogous. In addition to assigning grades, this activity also formally establishes the detailed system boundaries and refines the assignment of components to systems.

Component grading should not be attempted until there is a fairly complete set of design requirements and thus the necessary level of detail. Initial component-related activities should focus on establishing system boundaries and assigning components to systems. Initial or default component grades equivalent to the associated system grade may be assigned until the design requirements information is complete. If design reconstitution is necessary, the formal review of on-hand design information documents should be completed fairly early to facilitate component grading. A flowchart for component- level grading is presented as Figure 2–8. List of SSCs. A complete list of facility components is essential if all possible SSCs are to be considered for inclusion within the CM program. Existing configuration information in the form of a Master Equipment List (MEL), required by DOE 4330.4A, Maintenance Management Program, or the equivalent may be an adequate starting point for component evaluation. The initial CM program assessments will examine the need for facility walkdowns to establish accurate facility drawings and equipment lists. The CM program plan will reflect the results of these initial assessments. If comprehensive walkdowns are not necessary and the component lists are essentially complete, system boundary evaluation and component grading can proceed. However, if walkdowns or other activities are needed to define a complete list of facility components, they will have to be coordinated with component grading. The validated MEL should be combined with CM equipment data to form a single, complete equipment list for the facility, contained in the CM equipment database, that will satisfy all data owners and users. The first several steps shown in Figure 2–8 identify the scope of components that need grading. Known components should be sorted into systems with other components that have the same basic functions and processes or are located or connected together. Only systems that meet the CM program equipment scope criteria need to be considered during the component-level grading activity. The next step refines the system boundaries. Components are already assigned to systems at most facilities. Following the refinement of system boundaries, it may be necessary to adjust the assignment of components to systems. System Boundaries. Facilities should carefully evaluate and define system boundaries. Systems should contain those components that are necessary to fulfill the system's design requirements (e.g., the functional and performance requirements). Design codes and standards often identify reasonable and natural system boundaries. The following system interface considerations may apply to system boundary evaluation: • Location of piping class breaks • Location of isolation valves • Location of seismic class breaks • Location of test features • Supporting features and functions DOE–STD–1073–93 II-27 DOE–STD–1073–93 II-28 In establishing boundaries between facility systems and essential supporting systems, arbitrary but reasonable boundaries may be defined. Essential support services include electric and control power, instrument air, lubricating oil, and ventilation.

There are two primary approaches, one recommended and one alternate, for establishing system boundaries for essential support systems. The recommended approach is to extend the safety system boundaries to include essential support items out to an appropriate interface, such as an isolation valve. The alternate approach Is to deem the essential support systems to have safety portions. According to the recommended approach for air-operated equipment, the air controller, solenoid switches, and air isolation valves would be considered part of the basic safety system, while equipment upstream of the valve would be considered part of the instrument air system. According to the same approach for electrically operated equipment, the electrical components, including limit switches, out to and including the first breaker, would be considered part of the basic safety system, and the components upstream of the breaker would be considered part of the electric power system. Assignment of Component Grades. Component grades should be assigned in a manner analogous to system grading. Best Available Design Information should be used to identify the design requirements associated with each component and determine the design requirement types associated with each component. In some cases, the design requirements might indicate that a component is not essential to the system's top-level function. For example, a safety cooling-water system might have a chemical release monitor with an environmental design function, but no safety design function. Component grades should be assigned on the basis of the applicable types of design requirements. The component grade should be based on the most important type of applicable design requirements. As previously stated, the default component grade is the same as the system grade. In many cases, the component is graded consistently with its system. The net result of component grading may be the downgrading of certain components that are not essential to the top-level category of design requirements for the system. For example, local instrumentation to support maintenance might not be needed to fulfill either safety, environmental or mission requirements. If there is any doubt with regard to downgrading a component, the component should retain the system grade until associated design requirements are fully reconstituted. If a component appears to have design requirements of a higher grade than its system, the system might be incorrectly graded or the component might be in the wrong system. With the exception of components whose design requirements have been established and found to be adequate and outside the equipment scope criteria, all components within a CM system should be included in the CM program, even those without a safety, environmental, or mission function. Once the design requirements are fully established and adequate, the CM equipment scope criteria may be used to consider component exclusions. However, the inclusion of components other than safety, environment, and mission ones is generally advisable for CM systems to enhance overall configuration control.

As with system grading activities, other ongoing activities will periodically identify new information relevant to component grading. New design activity, for example, might add new systems as well as new components to existing systems. The DR adjunct program might uncover facility design requirements that affect component grading. Moreover, system walkdowns or operational activities might identify previously overlooked components. The impact of new information on component grading should be taken into consideration. While component grading is generally a one-time activity, its results are subject to review and revision as necessary when new information becomes available. DOE–STD–1073–93 II-29 2.2.3 FULLY DEVELOPED ELEMENT A schematic for the fully developed design requirements element and its program interfaces is presented as Figure 2–9. The design process can be initiated through change control processes that involve requests for a wide range of engineering design support - from major permanent facility physical changes to engineering evaluations for adjusting operations setpoints or revising maintenance and testing requirements. Requests for engineering design typically include a description of the problem and sometimes include a requested or proposed facility change. This information contributes to the design inputs for the design process. After the design process establishes new or revised design requirements and their basis, the approved design requirements are processed through the change control processes necessary to authorize, implement, test, and document physical changes in the facility or changes in facility documentation. When a design change affects neither the physical configuration of the facility nor facility documentation, the approved design output documents may go directly to the document control program element for a records update and distribution as appropriate. An example of this type of design change would be a design reanalysis that discloses the need for a reduction in heat exchange capacity from 88 to 80 percent. Design basis documentation may also be forwarded to document control for storage and future retrieval. Revisions to the design requirements that affect the assessments element should provide appropriate review and for execution of the various assessments element functions. For example, a design change might specify in-service testing or post-modification testing requirements. Additionally, design requirements might specify periodic monitoring criteria and methods. 2.2.4 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN REQUIREMENTS ELEMENT With respect to the establishment of the design requirements and design basis, a distinction is made between new work and reconstitution. Design requirements and design basis should be developed for new design work. For the reconstitution process of retrieving and regenerating existing design requirements and design basis, these functions should be adjusted according to a graded approach, as described in Chapter 3. 2.3 DOCUMENT CONTROL ELEMENT Development of the document control element is discussed below in two stages: the initial development activities and the fully developed program element. The initial development activities include those actions necessary to identify and evaluate the existing population of documents and document processes. The fully developed program element comprises the activities involved in ongoing, steady-state document control.

2.3.1 INITIAL DEVELOPMENT ACTIVITIES Initial development of the document control element is depicted in Figure 2–10. 2.3.1.1 Identification of Documents To Be Included In CM Program Early in CM program development, a determination should be made as to which documents will be included. The steps necessary to accomplish this are as follows: FOR DOE–STD–1073–93 II-30 Yes Yes Yes DOE–STD–1073–93 II-31 DOE–STD–1073–93 II-32 • Identify document types used at the facility. • Determine which document types should be in the CM program. • Determine which specific documents should be in the CM program. First, a complete survey of document types in use should be conducted with support of the various organizations at the facility. Each organization should identify the document types it prepares and the important document types it uses. Document types identified during the initial assessments should also be addressed. After document types are identified, a document owner should be assigned to each document type. The natural document owner is the person or organization responsible for developing and revising the technical content of documents within the assigned document type. The owners should review the document types for which they are responsible to identify those important for supporting the CM program objective and criteria. They should then perform an importance evaluation In light of their experience with, and knowledge of, the document types. Document scope criteria may vary according to the importance of the SSCs involved. These criteria should be defined to include only those document types that support the design or operation of facility SSCs included In the CM program. Document types that reflect the facility's design requirements and those that are necessary for day-to- day operation should receive the highest priority for inclusion in the CM program. Finally, the document owners, with the assistance of those persons responsible for the document retrieval function, should identify the individual documents within each document type and determine which of these documents should be included in the CM program. To accomplish this, a determination should be made as to whether that document supports an SSC that is included in the CM program. The CM program equipment scope criteria and the specific list of SSCs within the CM program, if available, should be provided to the document owners for support in their evaluation. For example, if Quality Receipt Inspections were a document type to be included in the CM program, it would not be necessary to include inspections that pertain to equipment not included in the program. The intent is to include only those documents necessary to support configuration management. Documents specifying requirements for day-to-day operations (e.g., procedures, drawings, vendor-supplied documents) and those necessary for modifying the facility (e.g., design requirements, design calculations, accident analyses) should be Included. If there is any doubt, the document should be included in the CM program. It may be advantageous to coordinate this activity with the design reconstitution document searches described in Section 3.2.

After identification of the specific documents for inclusion in the CM program, the following information on each document should be recorded in the document databases to facilitate tracking and control: document type, unique document number, and document uses and priority. This information should be retained. Selected document information (e.g., SSC-specific drawings, procedures, and vendor information) should also be entered into the CM equipment database to establish a cross-reference or link between SSCs within the CM program and the associated documents. 2.3.1.2 Review and Upgrade of Existing Document Control Processes For each document type to be included in the CM program, the adequacy of the existing document control process should be evaluated against each of the basic document control functions. A survey of existing document control processes should be conducted to identify the process that either identifies, stores, controls, tracks, or retrieves the included document types. After the document control element is developed, documents within the CM program should be processed in a manner consistent with the model shown in Figure 2–11, as discussed in more detail in Section 2.3.2. DOE–STD–1073–93 II-33 DOE–STD–1073–93 II-34 Each identified document control process should be reviewed against the expectations for the fully developed program. Deficient document control processes should be upgraded as necessary. For example, if piping and instrument drawings (P&IDs) are to be included in the CM document control element and it is determined that little formal control exists, the existing P&ID document control process should be enhanced consistent with the requirements established by the CM document control element. Various document control processes may also need to be consolidated to provide a consistent, reliable approach. A centralized document control process is often the most efficient and effective, particularly for the storage, tracking, and retrieval functions. A centralized approach should include satellite document distribution stations if needed for user support. The establishment of an effective document database should begin during the initial development stage. As discussed in connection with the program management element, this involves a review of existing databases, consolidation and upgrades as necessary, and the addition of any missing document data. The document database is integral to the control and tracking function and the retrieval function of this program element. 2.3.2 FULLY DEVELOPED ELEMENT The following discussion presents recommended methods for and features of the basic document control functions reflected in Figure 2–11. 2.3.2.1 Identification of Documents The process for evaluating newly identified documents is similar to that outlined in Section 2.3.1. As new documents are generated, they should be reviewed for inclusion into the CM program. To accomplish this, the document owner determines if the new document supports an SSC within the CM program or satisfies other scope criteria established for inclusion. Once included, the document owner should categorize the new documents according to document type and identify their uses and establish importance to users. Either the document owner or document control organization should uniquely number each document and prioritize that document consistent with its importance. The appropriate data on the document should be entered into the document database with the appropriate data fields completed.

New types of documents may also emerge and have to be identified for inclusion in the CM program. The identification of new document types for inclusion into the CM program should be considered whenever new document types are established. 2.3.2.2 Storage of Documents The objective of temporary and long-term storage facilities is to preclude damage or loss from deterioration, larceny, or vandalism. Methods of storage should be based on the particular characteristics of the document. Special consideration should be given to light-, pressure-, or temperature-sensitive documents (e.g., radiographs, photographs, film) consistent with applicable industry standards. Responsibilities should be assigned to ensure that records (active and inactive) and other documents are protected, preserved, and stored such that they can be retrieved within defined retrieval times. For example, a central document control organization may be assigned storage responsibilities. Storage and retention of documents should be in accordance with DOE Orders, specific commitments to DOE, national standards, and the needs of the document owners and users. Many of these storage DOE–STD–1073–93 II-35 and retention requirements are already established and in place. The document owners may specify retention times longer - but not shorter - than the minimums specified by DOE 1324.2A, Records Disposition. 2.3.2.3 Control and Tracking Figure 2–12 supplements Figure 2–11 by providing more detail on the process used to control and track documents. Control features aim primarily at ensuring that only the currently-approved revisions of documents are in use. Tracking features support this aim through the maintenance of information on the current status of documents and the provision of information on pending changes. The major features for the effective control and tracking of documents within the CM program are discussed below. Control Procedures. Procedures specifying the document identification, control, storage, and retrieval requirements should be developed and implemented to ensure consistency in, and to facilitate management of, the document control program. These procedures should establish responsibilities and, methods for each document control function. Document change notices (DCNs) should be used for the notification of document changes. Secure File. A secure master file of the original documents or master copies should be established and maintained. The master copies should not be released from that file; only reproductions should be provided, either on a regular distribution schedule or in response to specific requests. Strict controls should be established for the viewing of master copies. Access and security precautions should be established to ensure that the document master file is controlled and kept current. Controlled Document Distribution List. A controlled document distribution list should be established and maintained. That list should Identify both the documents that are to be controlled and the holders of copies of those documents. Users of documents should identify their document needs to the document owners, who should determine the users to be included on the controlled document list. The distribution list should include any satellite document distribution centers.

Identification of Proposed Changes. The document control organization should be notified of any need to change a document as soon as that need is identified and approved. A DCN may be used for this purpose. The document control organization, in turn, should provide a receipt acknowledgement of such a notice to the originator. The document control organization should update the document status in the document database. Notification of Pending Changes. Pending changes are those changes for which conceptual design has been approved and the design change is in process, those changes that have been approved for implementation, or those approved unincorporated changes that have been implemented in the field, but for which the document revision has not been completed. The document control organization should provide notice of pending changes to the persons on the controlled distribution list for the document involved. A notice of the pending change should also be attached to, or appropriately referenced on, the affected master document, in order to alert anyone requesting a copy of the document. Timely Incorporation of Changes. After the actual document changes are defined and are approved by the document owner, the changes should be incorporated onto the document master copy in a timely manner. The backlog of unincorporated changes should be controlled. Consideration should be given to incorporating small changes in batches. On the other hand, a large backlog of unincorporated changes adversely affects the value and usability of the documents. The number of unincorporated changes should be limited by establishing a threshold to trigger the incorporation of the outstanding DOE–STD–1073–93 II-36 DOE–STD–1073–93 II-37 changes for that document. The threshold level should depend upon the type of document, document priority, complexity of the changes, and the degree of overlap of those changes. For example, using such a threshold approach, the number of unincorporated drawing changes could be allowed to reach two to five changes per drawing before the changes were actually incorporated on the document. The document owners should also periodically monitor the incorporation of changes to ensure that the threshold levels are effective. Distribution of Documents. When a controlled document is issued or revised, copies should be automatically sent to those on the distribution list associated with the document, along with a request for written receipt acknowledgment. A receipt acknowledgement form may be used. Timeliness guidelines for distribution of documents should also be established. In some cases, prior to the formal document distribution, the most important documents, such as control room drawings are posted within 24 hours. Less important ones are posted within 72 hours. The least important ones are posted within 7 days. The recipients should update their copy of the document (for example, by inserting changed pages), and discard any obsolete pages or copies of documents. The recipient should then return written receipt acknowledgment to the document control organization. The controlled copies in use should be periodically reviewed to ensure their accuracy and their consistency with the master copies. Control of Superseded or Cancelled Documents. The document control process should include measures to ensure that superseded or canceled documents are replaced. ff a copy of a superseded or canceled document is requested, that copy should be clearly and distinctively marked as such.

Document Database. A database should be provided for use in tracking document status and pending changes. This database should contain basic information about the document, including the document number, the functional group or document owner, the document type, the current revision number, the current document status (e.g., in revision, recently revised, needs to be revised), information regarding pending changes, outstanding document change notices, and any other information necessary for control and tracking. As discussed below, the document database also supports the document retrieval function with associated information such as retention times, storage location, retrievability guidelines, and key words. The document database should be controlled in accordance with policy established by the program management element. 2.3.2.4 Retrieval of Documents Fundamentally, the document retrieval function ensures that documents are retrieved in a timely manner upon request, and that when a copy of a document is issued, it is the most recent version. The status of the controlled documents should be available to the affected organizations. Additionally, the retrieval function ensures that information regarding pending changes, including references to detailed information, is supplied to anyone requesting the latest copy of the document. For example, if a drawing is requested, the document control organization should also provide the requester with a list or copies of existing change information (e.g., outstanding document change notices, pending changes, and related physical changes in progress). This will alert the requester to upcoming changes that could affect the retrieved document. The document database needs to provide the capability to support identification of relevant documents. Numerous document identification systems possessing unique advantages and disadvantages regarding time and resources are available. Document identification systems range from the simple, manual control of hard copies to elaborate computer-based, keyword-searchable, full-text databases linked to the document images. Variables that affect the type and degree of sophistication are the size of the facility, the volume of documents included in the CM program, available resources, existing programs, and the retrieval requirements of the users of these documents. DOE–STD–1073–93 II-38 As defined in the program criteria, the document database should have the capability to identify documents within the CM program on the basis of their relationship to particular SSCs (such as a particular pump), types of SSCs (such as motor-operated valves), technical topics (such as fire protection), and other relational data (such as the specific vendor) necessary for the adequate identification of documents. This information should be integrated with the types of information discussed above (e.g., information regarding pending changes) for document control and tracking. Consideration should be given to assigning key words or using fully searchable text files for the most important documents.

Availability and retrieval times should be based on the needs of document owners and users. If the documents are necessary for the day-to-day operation of the facility, they should be available on a real- time or short-turnaround basis (e.g., controlled copies of procedures and P&IDs should be located in a central area such as the control room). Conversely, if the documents are not routinely needed and, if time permits, a retrieval time of 24 hours or more may be acceptable; this is typical, for example, of design basis information used by the design engineering organization for physical change preparation. Many documents included in the CM program fall into the latter category; immediate access is not needed. The selection of appropriate retrieval times calls for formally soliciting and considering input from the document owners and the ultimate users of the documents. This should be followed by periodic monitoring to ensure that document retrieval requirements continue to be adequate. Many facilities employ satellite document distribution centers to encourage the use of controlled copies and to facilitate timely retrieval from diverse work locations. In addition to DOE 5700.6C, ANSI/ASME NQA-1, Quality Assurance Program Requirements for Nuclear Facilities, NQA-1 Supplement 6S-1, Supplementary Requirements for Document Control, and Supplement 17S-1, Supplementary Requirements for Quality Assurance Records, also provide useful guidance on document control. 2.3.3 SPECIFIC APPLICATION OF GRADED APPROACH: DOCUMENT CONTROL ELEMENT The document control element is a process, and as such, the graded approach should not be used to eliminate any steps or functions. The identification of types and specific documents to be controlled by the CM program is a function that can be adjusted based on SSC grade. For any facility SSC, there is a fairly standard list of types of documents that could be included in the CM program: lists of materials, flow diagrams, electrical diagrams, isometric drawings, instrumentation logic and schematic diagrams, and calculations and analysis. In many cases, especially for the less important SSCs, many of these types of documents are not applicable or have never existed. Therefore, the inputs limit the scope. Additionally, for each SSC, a conscious decision should be made regarding how much documentation needs to be controlled to maintain configuration. For the most important SSCs, such as those with safety design requirements, it might be appropriate to control every document type and specific document that is available or can be retrieved. For low-importance SSCs, it might be appropriate to control only basic documents, such as the design requirements, flow diagrams, and test requirements. Documents that are not selected for inclusion within the special controls of the CM program would remain available in the normal document control system. Furthermore, management options may limit the degree of rigor and detail in the performance of the CM document control functions based on document importance, which in turn is based on the importance of the associated SSC and the priorities assigned by the document owners. DOE–STD–1073–93 II-39 2.4 CHANGE CONTROL ELEMENT The development of the change control element is discussed below in two stages: the initial development activities and the fully developed program element. The initial development activities include those actions necessary to identify and evaluate existing change mechanisms. The fully developed program element entails the activities involved in ongoing, steady-state change control.

2.4.1 INITIAL DEVELOPMENT ACTIVITIES Major change mechanisms and immediate actions to improve change control will have been identified by the initial program assessments and described in the CM program plan. This serves as the starting point for a complete review of existing change mechanisms or processes. During this evaluation, corrective actions should be Initiated promptly where necessary to prevent unauthorized, unreviewed, improperly controlled, and poorly documented changes. An overview of the initial development activities is presented as Figure 2–13, and these activities are discussed in more detail below. 2.4.1.1 Change Process Identification A survey should be conducted to identify each change source (such as operations, maintenance, procurement, procedures, and software) for each major change type (physical changes, document changes, or design changes resulting in either). Facilities should focus on each change type (physical, document, or design) individually to determine which sources initiate these changes and which mechanisms are used to identify, evaluate, and control these changes. Input from each facility organization should be solicited to identify the change sources and the control processes currently in use. All change sources, mechanisms, organizations, and control processes that can possibly affect configuration management should be identified. The identification of change processes is often the most critical step to achieve effective change control. Change mechanisms that are not identified cannot be controlled. Facility personnel should strive to identify subtle change sources that do not conveniently fall in one of the previously identified sources. Some change mechanisms exist independent of formal procedures or processes. For example, if the system engineer approves minor changes such as different gaskets, this should be identified and reviewed as a change source. Mechanisms for temporary physical changes and temporary document changes should be identified for formal change control. 2.4.1.2 Change Process Evaluation After the various sources of change have been identified, a determination should be made regarding which of those processes after the configuration and therefore need formal controls. Formal control measures should be provided for any change process that affects either (1) the physical configuration, as defined by the SSCs included in the CM program or (2) the facility documents included in the CM program. An example of a change mechanism that might be out of scope is the control of scaffolding that cannot affect an SSC within the CM program (i.e., no system interaction through failing, etc.) or its associated documentation. The adequacy of the existing controls should be evaluated against each of the basic change control functions, depicted in Figure 2–14 and described in Section 2.4.2. Checklists may be used to ensure that the evaluations are complete and documented. Any weaknesses or deficiencies should be identified. For example, if operations or maintenance personnel make undocumented changes to the facility, existing controls are not adequate and do not meet the objectives of the CM program. Similarly, if operations or maintenance personnel make changes without considering and documenting whether ALL Yes DOE–STD–1073–93 II-40 DOE–STD–1073–93 II-41 DOE–STD–1073–93 II-42

these changes are supported by the design requirements, the associated change mechanisms need attention. Corrective actions should be initiated promptly where necessary to prevent unauthorized, unreviewed, improperly controlled, or poorly documented changes. The conditions that initiate the change mechanism and the organizations that use the change mechanism should also be documented. This information will support the evaluation of potential consolidation of existing change mechanisms. It will also be useful as a starting point for a listing of change mechanisms that should be Included in the governing change control procedure. 2.4.1.3 Change Process Elimination, Consolidation, and Upgrade For each change mechanism, a determination should be made as to whether it will be retained, improved, or terminated. When deciding which change mechanisms to retain, consideration should be given to (1) the extent and impact of improvement actions necessary to eliminate deficiencies and weaknesses and (2) potential consolidation with other similar change processes. The ability to effectively manage many change processes should be considered. Consolidation of a deficient change process with a similar, acceptable change process is often preferred to upgrading the deficient process. A typical facility may have a number of different organizations making changes to the facility using many different control mechanisms. As a result, unnecessary management and control problems can arise. To minimize these problems, consideration should be given to consolidating as many types of changes as practical into a few well managed control processes for use by all facility personnel. For example, various temporary physical change mechanisms, regardless of which organization (e.g., Engineering, Operations, Maintenance) is making the change, can be consolidated into a single process. For each change mechanism retained, upgrade actions should be defined to bring the process into alignment with accepted methods and requirements established by the change control program element. For example, the temporary change control process might be upgraded to include the following needed features: technical reviews of proposed temporary changes prior to implementation; preparation and distribution of interim, marked-up drawings and procedures for use by operators and other facility personnel; and periodic assessment (e.g., at least every 6 months) of the continued need of the temporary change until removal. Change processes should be streamlined and efficient to ensure that they are used. Also, they should be enhanced to accommodate change faster and easier. Change processing should be defined by procedure for each approved change mechanism. Streamlining of internal program forms and documents is important to improve comprehensibility and ease-of-use. This applies throughout the CM program, but is particularly applicable to change control, which directly interfaces with the most organizations and personnel. Effective internal forms and documentation associated with change control have the following attributes: they facilitate complete and timely change identification and control, they are user-friendly and encourage participants to use them, and they provide for management tracking and reporting.

Upgrade and consolidation of change mechanisms typically include revised procedures, revised forms, and associated training. Active involvement of the process owners in answering questions and providing clarifications can be critical to a smooth transition to new or different processes. An effectiveness review of the upgraded or consolidated processes after 6 to 12 months can be very useful in defining further improvements and efficiencies. The initial development of the change control element is complete after the change control processes have been identified, reviewed, consolidated, upgraded, and determined to be acceptable. DOE–STD–1073–93 II-43 2.4.2 FULLY DEVELOPED ELEMENT Under fully developed change control, changes may only be identified, reviewed, approved, implemented, and documented through change processes that have been determined to be adequate. The following discussion presents recommended features of, and methods for, accomplishing each of the basic change control functions, presented in Figure 2–14. 2.4.2.1 Identification of Specific Changes Specific changes should be identified only within established change processes. The need for a potential change may be identified by anyone within the facility and should be documented by the requester to support the processing of the change request. As defined by the CM program criteria, each proposed change should be described adequately to support technical and management reviews prior to approval. Change initiation should include the name of the requester, a description of the proposed change, the affected SSCs and associated SSC grade, the reason for the change, alternative solutions, due date, and constraints. It should also include any other information needed for review, tracking, approval and further processing. 2.4.2.2 Technical Review of Changes Effective change control involves formal, multidisciplined, technical reviews for each change. Some of these are necessary to maintain configuration and others are defined as good management practices. The technical reviews defined by the CM program criteria to maintain configuration can be grouped into these areas: design envelope review; identification of affected hardware and documents; identification of post-implementation acceptance criteria; and, safety, environment, and mission reviews. Design Envelope Review. Design envelopes are pre-approved limits or constraints within which changes may be made within the bounds of the design requirements. For example, suppose the design authority has approved three different lubricants as acceptable for a given valve and specifies that they may not be mixed. If the maintenance organization desires to switch from one approved lubricant to another, the change needs to be recorded and documented; however it is not a design change. As another example, suppose the design authority has specified a pump actuation setpoint as 55-65 psig and the operating organization has requested the actual setpoint of 62.5 psig to be reduced to 57.5 psig to reduce spurious actuations. Again, the change is a physical configuration change, which needs to be documented, but it is not a design change. As a third example, if the design authority has determined, by evaluation, that the maximum number of plugged tubes for a specific heat exchanger cannot exceed 15 percent, this value becomes the design envelope for future maintenance work. Up to this limit, the maintenance organization does not have to check with the design authority each time it needs to plug tubes because the number is within the design envelope. However, if the maintenance organization needs to exceed this limit, evaluation and approval by the design authority needs to be obtained, and a new design envelope may be established. The same approach may also be used for setpoint changes, torque values, machining tolerances, vibration limits, or other routine activities where design envelopes can be established.

Changes that are shown to be within existing design requirements or defined design envelopes do not need evaluation by the design authority. Any personnel or organization, such as operations, maintenance, technical support (i.e., system engineers), or others, may perform the design envelope review, provided they are competent to make such an evaluation and have access to the appropriate design requirements, or specific design envelopes. The CM equipment database provides access to design requirements and design envelopes. Figure 2–15 shows the general approach for performing design envelope reviews, described further below. Yes Yes Yes Yes Yes DOE–STD–1073–93 II-44 DOE–STD–1073–93 II-45 First, a determination should be made regarding the desirability of design engineering support. Design support may be desired for many reasons. If the organization performing the design envelope review determines that design engineering support is desired for the design envelope review (e.g., based on known changes to the design requirements or technical complexity), a request for design engineering assistance should be made. Requests for design assistance may be made through the systems engineer, the facility technical support organization (or other interfacing entity) or directly to the design authority. If the reviewing organization does not desire design support, the reviewer should determine if the necessary design requirements or design envelopes are available for the review to proceed. If not, assistance from the design authority is needed and should be requested. If requested, the design authority could search the applicable information sources (such as the CM equipment database, calculations of record, and design basis information) and provide this information to the requesting organization to allow them to proceed with the design envelope review. If the design requirements are not available, the design authority may need to develop new information, which will be included in the CM equipment database. The design authority may also define design envelopes for future use. If the design requirements are available, the proposed change should be compared to the design requirements to determine if it is within the existing design envelope. The proposed change is ready for additional technical reviews upon determination and documentation that the change is within the bounds of the applicable design requirements. Organizations outside the design authority should be conservative in their review of design requirements. The design engineering organization should be consulted when there is any doubt as to whether the proposed change is within the design envelope.

If the proposed change is not within the design envelope, it involves a design change and design engineering assistance is necessary to proceed. In some cases, the revised design requirement is within the current design basis and, therefore, could be approved with relative ease. If the proposed change is beyond the current design basis, the development of a new or revised design basis is necessary to support the change. The new or revised design basis generally involves significant efforts by the design authority and potentially includes external evaluations and approvals. In such a case, the facility management would weigh the development time and investment against the benefits of the proposed change. An adjusted, more cost-effective change might be possible that could accomplish the objectives of the original change within the current design basis. Administrative review and approval to develop the proposed design change should be obtained. The design authority can recommend three general courses of action: (1) change the design requirements after reviewing applicable design basis information; (2) suggest that the change request be canceled; or (3) suggest that the proposed change be revised, if possible, to stay within the limits of the existing design requirements. The requesting organization should select the option. For physical changes that are to be implemented, the design authority should prepare a design change package consistent with the design process and controls. The design change package may accomplish the additional technical reviews and should facilitate outstanding technical reviews, management review, and implementation (i.e., with no further action by the requesting organization). Identification of Affected Hardware and Documents. Once it is determined that a change can be made within the defined design envelope or within new or revised design requirements, each affected SSC or document within the CM program needs to be identified. This includes the documents that are directly affected by the change, such as drawings. It also includes those that are indirectly affected by the change, such as the SAR or a procedure containing a system drawing that will no longer be accurate. By complete and thorough review, each affected item may be identified, thereby maintaining the basic CM relationships during implementation of the change process. Examples of affected items that are sometimes overlooked are design basis information, safety analysis reports, CM databases, operating and maintenance procedures, and training lesson plans. The CM equipment database and the DOE–STD–1073–93 II-46 document database should be used as primary tools to identify affected documents. Cross-disciplinary and cross-organizational review may also be necessary if the databases do not provide adequate information to complete this review. Identification of Post-Implementation Acceptance Criteria. Methods and acceptance criteria should be defined for post-implementation testing (e.g., post-modification testing for physical changes) prior to change implementation. Post-modification testing ensures that the SSC performs as intended and operates within the design requirements after the change is installed and before turnover to operations. These tests serve as a final and independent adequacy check of the design and technical reviews for the proposed change.

Safety, Environment, and Mission Reviews. Each change needs to be reviewed to ensure that the safety, environment, and mission objectives are preserved. Other Reviews. The following examples illustrate other reviews likely to be associated with change development and approval, but not necessary to maintain configuration. Reviews performed as a matter of good practice might include a review to determine the costs and benefits associated with a change in order to facilitate management reviews and decision making. Facility walkdowns may be necessary because there is a lack of confidence that the physical configuration is accurately reflected in the as-built drawings. As another example, once the change is fully defined, the impact on the operations schedule for implementation would generally be reviewed. Some technical reviews of changes are imposed by external requirements. For example, DOE 5480.21, Unreviewed Safety Questions, requires review of each proposed change to determine whether prior DOE approval is required. In addition, DOE may have established additional reviews and review criteria consistent with its management and oversight of the DOE-owned facilities. Additional reviews for determining quality assurance actions may also be necessary. Some DOE facilities use Change Control Boards (CCBs) for all or part of the technical evaluation of changes. For CCBs to be effective, they need to perform the technical review functions discussed above or ensure that they are performed for each change. 2.4.2.3 Management Review of Changes As defined by the CM program criteria, management should review the proposed change to verify that the technical reviews have been performed adequately, the change package is complete and ready for implementation, any necessary external approvals have been obtained, and that the change is authorized for implementation. Management reviews may also consider whether the need for the change exists, whether the benefits of the change warrant the cost and schedule impacts, whether adequate resources are available for implementation, or whether management approval should be based on other criteria. Some aspects of these management reviews may take place prior to finalization of the change package; others, subsequently. For example, management review and approval of proposed major design changes would be expected prior to significant expenditure of resources. Management review and approval requirements may vary based on the magnitude, cost, or the importance of the change (grade of SSCs involved). For instance, changes related to safety SSCs might call for senior management approval, while changes related to low importance SSCs might call for only the approval of first-line management. DOE–STD–1073–93 II-47 The management review process should be streamlined to the extent practicable. Management reviews by many different levels and organizations can dilute accountability for a substantive review and increase the review cycle duration without adding value. 2.4.2.4 Implementation of Changes The change package should be reviewed prior to actual implementation of physical changes to ensure that it is complete and constructible, that there are no unidentifiable physical interferences, and that the change is likely to meet defined post-implementation acceptance criteria. This constructability review should be performed independent of the original design organization. A modification or construction package may be used to define implementation instructions.

Any deviations from the defined change package during implementation/construction should be identified, reviewed, and approved by the design authority. Provisions for this process, often called field change requests, should be defined by procedures. Following engineering evaluation and approval, field change notices should be issued. As-built documentation should be prepared at the completion of implementation of physical changes. Post-modification testing should be performed in accordance with methods and acceptance criteria defined during the change development. If an SSC fails to meet the post-modification acceptance criteria, it should not be turned over for normal operations until either a technical review and any necessary follow-up actions have been completed, or the SSC is returned to its original condition and tested satisfactorily. Special attention should be given to the partial implementation of changes. Two types of partial implementation can occur: (1) staged implementation, where availability of time, money, or equipment dictates that the modification has to be planned and implemented in a staged manner or (2) interrupted implementation, where the implementation could not be completed as planned for any of a variety of reasons. Failure to identify this condition and take the proper precautions can lead to the premature closure of the modification package resulting in an unanalyzed condition, as well as facility documentation that does not reflect the as-built configuration. Partially implemented changes should be reviewed and approved by the design authority prior to operation. This design engineering review should ensure that the original technical reviews are still valid or that new technical reviews are performed, as necessary. 2.4.2.5 Documentation of Changes Change documentation is produced at each step of the change process (i.e., identification, review, approval, and implementation). This is necessary to indicate what is accomplished, to ensure that the details of the proposed change are established and understood, and to record as-built information. The change documentation function is established as a unique and separate function within the change control element to emphasize that change closeout ensures that the change documentation is complete and all affected documents are identified and updated. Because essentially every change directly or indirectly affects associated documentation, a major interface exists between the change control and document control elements. Directly affected facility documents, such as drawings, are confirmed to be as-built following implementation. Indirectly affected documents are identified as part of the technical review of changes. The affected documents should be updated in a timely manner. Critical facility documents, such as drawings and procedures needed for operation, should be updated prior to placing the SSC in operation. DOE–STD–1073–93 II-48 Change packages should be used to capture the change request, the various technical reviews and evaluations, the management review, and the implementation results. Related information (such as the change request, design package, installation package and, post-modification testing) should be combined into a single file or change package. This information should be kept in one location until installation is complete. Furthermore, consideration should be given to assigning an individual the responsibility for tracking physical change status and ensuring that the change package is complete at all times up to and including turnover to the document control organization after installation. Many facilities have successfully used system engineers to perform this function.

2.4.3 SPECIFIC APPLICATION OF GRADED APPROACH: CHANGE CONTROL ELEMENT Like document control, change control is a process. Once a design requirement is established for an included SSC or a change is proposed, that information should be controlled by the change control element. The level of effort is influenced primarily by the number of specific SSCs included in the CM program and the number of changes that are proposed. However, management may exercise options to limit the degree or rigor and detail when reviewing and approving changes based upon the importance of the SSCs involved. For example, adjusting the degree of technical reviews and management sign-offs to be commensurate with the SSC grade is appropriate. 2.5 ASSESSMENTS ELEMENT The assessments element may be considered fully developed on completion of the following • Initial CM programmatic and physical configuration assessments • Detailed action plans and procedures for conducting post-implementation assessments • Ongoing assessment programs established by procedure and effectively implemented Senior management should retain overall responsibility for management assessments (i.e., all initial and post-implementation assessments and the periodic program effectiveness assessments). Direct participation of senior management during these assessments is essential. This process should also involve other levels of management, as appropriate. Management assessment results should be documented. Senior management should take prompt action and document resulting decisions in response to recommendations resulting from the management assessment process. Follow-up should include an evaluation of the effectiveness of management's actions. 2.5.1 INITIAL ASSESSMENTS 2.5.1.1 Vertical Slice Assessments The following is a description of the vertical slice assessment process. An overview of that process is presented as Figure 2–16. Identify the systems to be assessed. System selection is determined using judgment and anticipated need to obtain a representative cross-section of existing SSCs, control programs, and document types. For large, complex facilities, two or more vertical slice assessments are usually needed to detect patterns and major existing problems the larger the number, the more accurate the results. As defined by the CM program criteria, at least two representative vertical slice assessments should be performed, with one on a safety system related to the principal facility hazard. Collect and compare system-related information. A comparison is made between the available design basis information and design requirements to determine consistency and technical adequacy. Special Technical Adequacy Review Sum - - - - - - - - - - - - - - Differences Compare by Walkdowns DOE–STD–1073–93 II-49 DOE–STD–1073–93 II-50 attention should be given to consistency between the assumptions made in different design basis calculations; the design basis documentation and design requirements documentation; and, the design requirements against one another and as reflected in the SAR, procedures, vendor material, and other sources of design requirement information. Another comparison should made between documents containing the design requirements and the as-built documents (such as drawings and procedures). Inconsistencies, technical inadequacies, and missing information should become preliminary assessment findings to be analyzed further.

Perform walkdowns and compare the existing physical configuration to the facility documentation. Walkdowns are an integral part of a vertical slice assessment. They are performed to establish the as- found facility physical configuration, the results of which are compared to the associated documentation in order to identify discrepancies. Initial walkdowns provide insight Into the accuracy of existing facility drawings. Walkdown methods and follow-up actions are addressed in the discussion of physical configuration assessments In Section 2.5.3.2. Evaluate preliminary assessment findings to identify programmatic strengths and weaknesses. Correcting each specific finding without determining the programmatic deficiencies that allowed these findings to occur is not the objective. Final analysis of the findings should result in the determination of the extent of weaknesses and the underlying causes. For example, a discrepancy between the existing configuration and the as-built documentation might be due to inadequate interfaces between the change control and document control programs, while differences between the design basis information and design requirements might be due to inadequacies in the design engineering process. Once programmatic strengths and weaknesses are identified, this information should be factored into the associated CM program plans to assist in CM program development. Develop corrective actions. As a result of the initial assessments, corrective actions should be developed to address the identified weaknesses. Recommendations should be made addressing programmatic deficiencies that, if corrected, will prevent these types of problems from occurring in the future. The CM program management will evaluate the initial assessments, including recommended corrective actions, and determine the appropriate actions for the facility. Program management should take immediate corrective actions to remedy the major programmatic weaknesses. Further, specific interim upgrades may be prudent in areas such as change control, document control, design control, and physical configuration determination. 2.5.1.2 Horizontal Slice Assessments The horizontal slice assessment process is described in the following sections. An overview of that process is presented as Figure 2–17. ldentify the programs or topics to be assessed. Likely candidates for horizontal assessments are the change control program, the document control program, the design change process, a topical program common to many SSCs, the design requirement documentation and design reconstitution efforts (if underway at the time). As defined by the CM program criteria, at least two initial horizontal assessments should be performed. One is to be conducted on the change control program and another in a topical area such as seismic, fire protection, or environmental qualification. Develop evaluation criteria that define the requirements for the program. These evaluation criteria are similar to the performance objectives and criteria used by DOE and the commercial nuclear power industry for conducting performance-based assessments. Examples of upper-tier evaluation criteria in various areas of the CM program are as follows: DOE–STD–1073–93 II-51 DOE–STD–1073–93 II-52 • A formal CM program is in place and governed by published directives, a CM program plan, and CM implementing procedures.

• Organizational and programmatic interfaces, including responsibilities and authorities, are clearly defined and understood by key personnel responsible for implementing CM program functions. • The design requirements for SSCs included in the CM program are identified, documented, retrievable, and maintained current for use by facility personnel. • Change mechanisms are identified and controlled. • Proposed changes to facility hardware and documents are technically reviewed to ensure consistency with the design requirements. • Changes are documented and affected documents are updated. • Documents within the CM program are consistent with the design requirements and the physical configuration. Compare existing program implementation with the evaluation criteria to determine strengths and potential weaknesses. Determine whether the existing program is comprehensive and identifies obvious omissions. Figure 2–18 shows the recommended method for evaluating existing procedures. Starting at the top left corner, the facility CM program criteria are identified by applying the graded approach to the general CM program criteria. The existing programs and procedures providing configuration management functions are then identified and analyzed. The program objectives, methods, and procedures are considered. Functional flowcharts are developed for the existing procedures. This evaluation of existing procedures can provide a basis for determining whether they are programmatically adequate for accomplishing the CM program criteria. Based on functional flowcharts, judgments can be made regarding the strengths and weaknesses of the processes prescribed by the procedures. An assessment can be made of how well the procedures achieve their objectives and whether the procedural links and other interface considerations are adequate. Using the functional flowcharts, an assessment also can be made regarding how well the functions actually provided by the existing procedures match the functional criteria of the facility CM program. The comparison of the functional capabilities of the existing programs may show that no additional work is necessary to accomplish the CM program functions, or it will indicate where improvements are needed. The functional flowcharts for existing procedures may indicate strengths and weaknesses not related to the CM program; other improvements may be appropriate. Assessment of procedures without the aid of functional flowcharts can result in misleading conclusions. The time and effort involved in developing functional flowcharts is well invested. Perform an effectiveness review in the field. This review is an assessment of how well the program is implemented. During this step, information is gathered through interviews with knowledgeable facility personnel, additional document reviews, and observation of work in progress to determine the program's effectiveness at accomplishing the objectives. Therefore, emphasis during the effectiveness review should be placed on problems. This performance-based approach is essential to identifying the underlying causes of these problems and effectively upgrading a weak or poorly implemented program. This is not a compliance review. DOE–STD–1073–93 II-53 DOE–STD–1073–93 II-54

ldentify relevant programmatic strengths and weaknesses and make recommendations for improvements. Compare the potential weaknesses identified during the document review step with the problems identified during the effectiveness review step. Recommendations should be made to correct programmatic weaknesses and prevent these types of problems from occurring in the future. Strengths should be identified and acknowledged to ensure that resources are properly allocated for sustaining program strengths. This information should be factored into the associated CM program plans to assist in CM program development. The CM program management will evaluate the initial assessments, including recommended corrective actions, and determine the appropriate actions. 2.5.2 POST-IMPLEMENTATION ASSESSMENTS Post-implementation assessments to determine the adequacy and effectiveness of a program are conducted shortly after program implementation and prior to final turnover to facility personnel for ongoing use. These assessments are not compliance audits. Like initial assessments, these post- implementation assessments employ vertical and horizontal slice methods. Post-implementation assessments include CM program effectiveness assessments, DIS field validations, and MCA program effectiveness assessments. 2.5.2.1 CM Program Effectiveness Assessment Horizontal slice assessments should be performed shortly after each element of the CM program is implemented (i.e., within 12 months of program element implementation). The main objective of the CM program effectiveness assessments is to examine newly implemented CM programs and processes (such as change control, the design requirements process, and document control) to identify and correct weaknesses prior to authorization for use. These post-implementation CM program assessments also serve as a model for ongoing, periodic program effectiveness assessments. The horizontal slice assessment techniques used for the post-implementation CM program effectiveness assessments are identical to those employed in the initial horizontal slice assessments. The recommendations for improvement resulting from the initial assessments should be used as a starting point for the CM program effectiveness assessments. This will ensure that the previously identified problems have been adequately addressed and resolved. The post-implementation program effectiveness assessments should go beyond the initial assessment findings to ensure that the newly developed and upgraded programs are effective. Assessment findings and corrective actions should be documented. 2.5.2.2 Design Information Summaries Field Validations As each DIS is issued by the design reconstitution adjunct program, a field validation should be provided to ensure that the design requirements are accurately reflected in both the physical configuration and the associated facility documents. Each DIS may receive varying degrees of technical validation, ranging from a review of specific critical design basis information to detailed vertical slice assessments of the entire system. Within each DIS, the system engineer or other technically qualified person should check the critical design requirements information for consistence, with the hardware and documents on a case-by-case basis.

Full vertical slice assessments should be performed on a sample basis to provide a broader assessment of the design reconstitution process. The sample should be large enough to, provide assurance that design basis information and design requirements established by design reconstitution are accurately reflected in the physical configuration and associated documentation. A representative sample of at least 5 percent per facility would be prudent. In selecting the sample systems for these detailed DIS validations, the following criteria should be considered: status of original design and DOE–STD–1073–93 II-55 construction documents, system importance to safety and mission, change history, and number of outstanding open items identified during design reconstitution. Systems that support accident prevention and mitigation and design documents for which the accuracy of the original calculations and analysis were suspect, receive highest priority. If the representative sample indicates substantive weaknesses, immediate corrective actions and assessment of an expanded sample should be initiated. 2.5.2.3 MCA Adjunct Program Effectiveness Assessment An MCA adjunct program effectiveness assessment should be performed after the MCA program is fully implemented but prior to final turnover to facility personnel for continued use. The main objective of the MCA adjunct program effectiveness assessment is to provide a technical quality review of the MCA methods used, input assumptions, and final products. This review should be performed by persons other than those who did the work and should provide assurance that the MCA information was property developed and is technically appropriate and accurate for its intended use. Therefore, the MCA adjunct program effectiveness assessment should include, but not be limited to, an accuracy and appropriateness check of the following: • Final identification of the life-limiting components • Detailed MCA analysis (evaluation of aging mechanisms and conduct of baseline measurements) • Final determination of remaining facility lifetime • Trend analysis and monitoring • Life extension techniques (development and application) 2.5.3 ONGOING ASSESSMENTS 2.5.3.1 Periodic Program Effectiveness Assessments These assessments periodically examine existing functions and processes related to the CM program to ensure their continued effectiveness and to identify improvements and enhancements, if needed. Similar to the initial assessments, periodic program effectiveness assessments use a combination of vertical slice and horizontal slice assessment methods. Objective measures and criteria to assess effectiveness should be defined and used. These periodic assessments should be used as the technical basis for adjusting the CM program by increasing or decreasing the controls. Periodic program assessments should be performed at sufficient intervals (such as every 3 years for full vertical slice or horizontal slice assessments) after implementation to provide management with the assurance that these CM control programs are functioning as intended. 2.5.3.2 Physical Configuration Assessments Physical configuration assessments test whether the physical configuration is accurately reflected in the facility as-built documentation. Physical configuration assessments, or walkdowns, are an integral part of any vertical slice assessment, and therefore, they are included in initial assessments, post- implementation assessments (related to DIS field validation), as well as ongoing assessments.

While the processes of walkdowns, as-builting, and vertical slices have significant overlaps, the distinctions among them need to be understood. One distinction is based on the products of these processes. Walkdowns produce a set of marked-up documents that reflect the actual physical configuration and identify discrepancies with the currently-approved facility documentation. The as-- builting process produces as-built documents that have been field-verified and design-verified. Vertical slice products include an evaluation of the extent, significance, and root cause of discrepancies DOE–STD–1073–93 II-56 identified in walkdowns. Vertical slice assessments are primarily diagnostic and would not generally produce discrepancy resolutions or as-built documents. Walkdowns. During walkdowns, the as-found configuration is identified by comparing the existing physical configuration with the facility documentation to identify any discrepancies, typically by marking up the documents. Appendix 11–C provides detailed guidance for conducting walkdowns. Walkdowns are sometimes conducted to record manufacturers' nameplate data from equipment, to identify missing or incorrect equipment labeling, to determine the present material condition of equipment, and to identify potential physical interactions between equipment (such as non-seismically qualified equipment mounted In such a position as to impact seismically qualified equipment during an earthquake). Physical configuration assessments may be performed on a sample basis, with the sample providing a representative cross-section of component types within the system being assessed. The sample should be large enough to ensure that a statistically significant portion of the system and its components are chosen. For instance, the sample should Include major and minor components, large and small bore piping, and instruments and controls. Minimum thresholds for determining an acceptable number of discrepancies should be established prior to walkdowns based on proven statistical techniques (e.g., similar to those used in quality programs for the selection of samples and the determination of acceptability). If the initial physical assessments confirm that the facility documents accurately reflect the physical configuration, further physical configuration assessments should be included on a sample basis with periodic program effectiveness assessments. However, if the initial physical assessments indicate that substantive discrepancies exist (either in number or type) between the physical configuration and its documentation, appropriate immediate corrective actions should be identified to establish agreement between the physical configuration and the facility documentation. The corrective actions for substantive discrepancies include additional walkdowns to characterize and determine the extent of the problem. Sometimes the discrepancies can be isolated to certain systems, certain modification vintages, or certain change mechanisms (modification processes). If the extent of the problem can be limited, appropriate corrective actions can be directed at the root cause. Where control of the physical configuration has been lost, walkdowns of every important system may be necessary. In this case, a justification for continued operations may be necessary if continued operations are desired.

As-Builting Process. As-builting is a process that involves determining the actual physical configuration that exists at a point in time, identifying any discrepancies with the facility documentation, and technically resolving those discrepancies. In some cases, discrepancies arise simply because the facility documentation is incomplete or inaccurate in some details. In other cases, discrepancies arise because inadequately controlled hardware changes caused the physical configuration to become different from the facility documentation. The level of detail of a particular facility document type establishes the threshold of the corrections that need to be made. If a facility document provides, or is intended to provide, a level of detail that includes information that does not agree with the actual physical configuration, those discrepancies should be identified and resolved. Leaving incorrect or unverified information on a document is likely to mislead users of the document. Further, any information that is left on as-found documents and has not been verified should be clearly identified. The resolution of the as-found discrepancies needs a technical review to determine if the physical configuration is correct (in accordance with the currently-approved design requirements) or if the facility documentation is correct (the physical configuration is not correct). In some cases, the resolution of a discrepancy might be to establish the acceptability of the existing physical configuration and change the design requirements. Technical approval from the design authority (i.e., design verification) should be DOE–STD–1073–93 II-57 obtained on discrepancy resolutions to ensure that the final configuration is consistent with the design requirements. The end product of the process is as-built documentation that has been both field- verified and design-verified. 2.5.3.3 Periodic Equipment Performance Monitoring This ongoing assessment function verifies that selected SSCs continue to be able to perform their intended functions (i.e., meet their design requirements). Equipment performance monitoring is included in the CM program because it is important to maintaining the bonds between the physical configuration and the design requirements. The results of this monitoring function should be used to correct any equipment deficiencies that cause the equipment to deviate from the design requirements and to identify any root causes of performance degradation. The fully developed program should include (1) implementing procedures established to specify and control periodic equipment performance monitoring, (2) acceptance criteria defined consistent with the design requirements, and (3) testing procedures established for frequently performed tests. Performance monitoring programs should be implemented to routinely monitor, collect (using calibrated instrumentation), trend, and analyze performance data (including thermal, hydraulic, electrical, and mechanical data) for SSCs within the CM program. The methods of implementation should include procedures, checklists, or other guidance documents necessary to conduct these activities. Specific facility personnel, such as system engineers, should be assigned to each SSC and held responsible for the performance monitoring activities on assigned SSCs. This responsibility should include the establishment of performance goals and acceptance criteria consistent with the associated SSC design requirements. Examples of major tests that should be included in the performance monitoring program are as follows:

• Heat exchanger performance tests (e.g., fouling and heat transfer rate) • Pump performance tests (e.g., head versus flow tests) • Valve performance tests (including stroke times) • Vibration monitoring for major rotating equipment • Battery capacity and performance tests • Other major equipment tests, as applicable (e.g., diesel generators and inverters) The frequencies for each test should be specified in procedures and periodically reviewed to ensure adequacy. Reviewing trend graphs of collected equipment data at specified intervals is a proven, effective approach. For example, if the trend graph indicates that the equipment likely will not meet the acceptance criteria at or before the next scheduled test, an adjustment in the test schedule and other maintenance actions would be necessary. For cost-effective implementation of this function, the timely recognition of interfaces with existing program requirements is necessary. The equipment monitoring function interfaces with operations, maintenance, and systems engineering programs. In some cases, adjustments to existing programs may be sufficient to satisfy the need for ongoing CM assessments. Existing programs should be reviewed to determine whether they are adequately oriented to maintain configuration and support the objectives of the CM program and are adequately integrated with other important CM functions. They should also be reviewed to determine whether their scope is sufficient to address the full breadth of SSCs within the CM program. Surveillance testing is typically performed to satisfy regulatory, code, or other requirements to ensure operability of the equipment within established limits. For SSCs included in the CM program the results of surveillance testing should be used to detect and correct any deficiencies that cause the equipment DOE–STD–1073–93 II-58 to deviate from the design requirements. Surveillance testing techniques are similar in many ways to those used In SSC performance monitoring. A comprehensive surveillance testing program ensures that the identified testing is scheduled and performed, the results are reviewed and trended, and necessary corrective actions are taken to return equipment performance to within the design requirements. The periodic equipment performance monitoring function should take credit for periodic surveillance testing, where appropriate. Full integration of the surveillance test program with other periodic equipment monitoring can provide efficiencies in manpower and scheduling. Periodic testing, beyond that in the TSR surveillance requirements, may be adjusted both In frequency and degree of technical content based on the importance of the SSC or the particular SSC function. The origin of various testing requirements should be documented and maintained. DOE 4330.4A, Maintenance Management Program, establishes preventive and predictive maintenance activities, such as tests, inspections, diagnostics, and trending. It further requires that a documented basis for planned preventive and predictive maintenance activities should be provided. Existing program to satisfy these Order requirements should provide a good interface with the CM program. Existing programs should be reviewed to determine whether they are adequately oriented toward maintaining configuration and achieving the associated CM program objectives.

Aging degradation monitoring is an important subset of equipment performance monitoring. It is directed at detecting the impact of known and anticipated aging degradation mechanisms. The MCA adjunct program will establish the technical basis for inspection and testing activities to trend important characteristics, anticipate the time of failure, and detect component degradation, which can result in systems and components operating outside their design requirements. The results of the MCA program will be reviewed by the design authority to determine which should be implemented within the periodic monitoring function (i.e., new design requirements). The assessments element supports the MCA adjunct program by coordinating implementation of identified monitoring actions performed throughout the life of the facility (i.e., during ongoing MCA implementation, after development). 2.5.3.4 Post-Modification Tests Post-modification tests are performed each time an important SSC is installed or modified. These tests ensure that the SSC meets the design requirements and is verified to be operable prior to being placed into service initially or returned to service. This function prevents unintended changes from being introduced through errors during design or construction. For physical changes, these tests serve as a final and independent adequacy check of the design and technical reviews for the change. If a changed SSC fails to meet its acceptance criteria, ft may not be turned over for normal operations until either a technical review has been completed and any follow-up actions completed or the SSC is returned to its original condition and tested satisfactorily. The fully developed program should include (1) implementing procedures established to specify and control post-modification testing and (2) acceptance criteria defined consistent with the design requirements. A recommended approach is to develop a generic procedure for identifying the post- modification tests to be performed and to invoke this procedure each time a facility change is made. For the post-modification tests to be effective, test conditions should be consistent with normal and emergency operating conditions and acceptance criteria should demonstrate that the applicable design requirements are met. The dominant factor affecting the level of effort for post-modification testing is the complexity of the design change involved. DOE–STD–1073–93 II-59 2.5.4 SPECIFIC APPLICATION OF GRADED APPROACH: ASSESSMENTS ELEMENT The initial assessments are important in identifying the strengths and weaknesses of existing programs and procedures. Accordingly, the more thorough these assessments are, the more representative and accurate the findings will be. Initial assessments may be adjusted based on facility grade. As defined in the program criteria, at least two vertical slices (one on a principal safety system) and at least two horizontal slices (one on change control and one on a topical area) should be conducted. However, for some small facilities that have limited hazards and are not complex, the number of vertical slices and horizontal slices may be adjusted. The following table presents different levels of implementation for the initial assessments, based on the facility grade. ASSESSMENT TYPE FACILITY GRADE High Medium Low Minimal Vertical Slice Necessary Necessary Necessary Recommended Principal Safety System Horizontal Slice Necessary Necessary Recommended Optional Change Control

Second Vertical Slice Necessary Recommended Recommended Optional Horizontal Slice Necessary Recommended Optional Optional Topical Area This matrix applies to the case in which the facility grade is being applied directly to the CM program general criteria. In other words, no other graded approach considerations (such as facility remaining lifetime, etc.) have been applied. With application of other graded-approach considerations, the implementation level may be adjusted further and this matrix would serve as an example of relative priorities. DOE–STD–1073–93 II-61 CHAPTER 3 IMPLEMENTATION GUIDANCE FOR DESIGN RECONSTITUTION This guidance is appropriate for high-hazard facilities expected to operate for an extended period. Since DOE facilities vary in hazard level and circumstances of operation, a graded approach to implementation should be adopted. The implementation guidance is presented in the general sequence in which the design reconstitution (DR) adjunct program is expected to be developed and implemented. Figure 3–1 presents the top- level flowchart for the DR adjunct program. 3.1 PROGRAM PLANS AND PROCEDURES 3.1.1 DESIGN RECONSTITUTION PROGRAM PLAN The DR program plan should address the topics defined in program criterion 1.3.1.1.c. It should be prepared in accordance with direction set forth by the program management element of the CM program. Although part of the CM program plan, the DR program plan may be provided to DOE separately and should be developed as a stand-alone document. The DR program plan should identify the scope of the Design Information Summaries (DISs), for both the systems and for design topics, to be prepared. The DR program should prepare DISs for the systems within the CM program scope. To reduce redundancy and ensure consistent application of the topical information, the plan should identify design topics for which a separate topical DIS will be prepared. Potential design topics include seismic qualification, fire protection, environmental protection, electrical separation, single failure, and nuclear criticality. The DR program plan should provide the method for prioritizing DISs. The priorities of DISs may be based on safety significance, Technical Safety Requirements (TSRs) significance, probabilistic risk assessments, facility modification schedules, impact on other DISs, and the specific needs of the operating and design organizations. Highest priority should be given to those systems addressed by the facility accident analyses or TSRs. The priorities are used to establish the order of DIS preparation. As part of the description of each DR program activity, the DR program plan should reflect the chosen technical approach and methods for each DR program activity. Descriptions of program activities should demonstrate how the program functions will be accomplished. Within each activity, there are a number of management options that can only be evaluated and selected facility by facility. Examples of these management options are: • Selection of DIS topical areas • Detailed methodology for comprehensive search • Approach to management review to identify the missing basis • Prioritization methods for regeneration activities • Scope of regeneration activities • Approach to the selection of regeneration methods To clarify the DR program envisioned, program plans should describe selected options. The availability and reliability of existing design information are key in DR program planning. The need for the DR

Prepare Program Plan, Action Plan, and Procedures Identify and Retrieve Design Information Evaluate, Verify, and Validate Design Information Prepare Rev. 0 Design Information Summaries Regenerate Missing Critical Design Requirements Resolve Open Issues Discrepancies Regenerate Missing Critical Design Basis Prepare Rev. 1 Design Information Summaries Perform Field Validation Issue Rev. 1 DISs Issue Rev. 0 DISs - Formal Review - Smart Search - Comprehensive Search Figure 3-1. Design Reconstitution Program: Implementation Overview DOE–STD–1073–93 II-62 DOE–STD–1073–93 II-63 program is based on the completeness, accuracy, and full documentation of existing design information. The DR program plan should present the results and recommendations of the technical management review performed under the design requirements element of the CM program. It should reflect the graded approach and provide the basis for its application. The DR program plan should also reflect the relevant findings of the initial assessments, including: • Location of design documents • Availability of design documents • Control of design documents • Consistency of information among design documents • Immediate actions taken and planned Four examples of different situations regarding the availability and reliability of existing design information are: • Almost no information readily available • Moderate amount of information available; some essential information not readily available • Moderate amount of information available; reliability of information questionable • Vast amount of information available that is highly trustworthy The DR program plan should identify key interfaces with other programs. For example, the Safety Analysis Report (SAR) upgrade program is an important interface to establish. To this end, the DR program would need to include early coordination with the SAR upgrade program to prevent duplication and to ensure the effectiveness of both programs. The program plan should define interfaces with the design requirements program element of the CM program and other CM program elements. Phased Implementation. The DR program is performed in a phased manner with defined milestones and associated deliverables. A phased approach to design reconstitution provides for an initial set of design information, with further design information added as it is reconstituted. Each activity should be scoped, prioritized, staffed, and funded as appropriate to ensure attainment of the defined milestones. The program criteria call for the DR program plan to be provided to DOE for review within 6 months after the CM program plan is provided. Thus, the DR program plan may be provided to DOE up to 24 months following the initiation of CM program planning. Design reconstitution program activities should not be implemented before an adequate CM change control element is available. Sample milestones in design reconstitution beginning from the time DOE reviews the DR program plan (see Figure 3–2) are as follows: • DR action plan (0-6 months) • Formal review (6-12 months) • Smart search (1-2 years) • Comprehensive search (2-4 years) • regeneration of design requirements (2-5 years) • Pilot DIS program (2-5 years) • DIS Revision 0 completion (4-6 years) • Regeneration of design basis (4-6 years) • Field validation of DISs (5-7 years) • DIS Revision 1 completion (5-7 years)

The issuance of completed DISs is also phased by system and topic; as individual DISs are completed, they are issued. The phased preparation and issuance of DISs should be consistent with priorities established by the DR program plan. II-64 D O E -S T D -1073-93 II-64 DOE–STD–1073–93 II-65 Graded-approach considerations such as facility size and complexity can affect implementation schedules; small, low-complexity facilities could possibly complete a DR program much sooner than the sample milestones shown in Figure 3–2. Facilities that have already completed substantial design reconstitution could also finish sooner than those that have done little or nothing. 3.1.2 DESIGN RECONSTITUTION ACTION PLAN As described in Section 2.1.4.1, action plans provide additional detail to support program implementation. The DR action plan should identify the program manager and project organization. A clear management mandate and consistent management support are essential to success. Direct involvement by the primary contractor for the facility is also necessary to ensure ownership; knowledge retention; achievement of purpose; and continuing, effective DIS usage. Proper selection of the project team is vital. The DR action plan should also do the following: • Identify DIS content and format. Facilities may have somewhat different uses that the DISs will satisfy. A determination of the intended uses of the DISs provides the basis for the format and content of the DISs. Examples of potential DIS applications are provided in Appendix II–D. • Identify end users, as well as the review and approval process for project deliverables. Early input and feedback from end users is crucial to the usefulness and use of DISs. • Describe the DR governing and implementing procedures to be prepared. Such procedures establish management control over the processes for developing, reviewing, and approving DISs, and define and communicate the appropriate standards. • Address programmatic controls and procedures for implementation of applicable portions of the site/facility quality assurance (QA) plan. • Identify periodic assessments of DR program activities. Throughout program implementation, it is important to maintain a broad perspective and a questioning attitude regarding assumptions and the use of information from reference documents, as well as the relationships and use of information from resource documents. Periodic assessments can supplement training and supervision in ensuring that a questioning attitude is maintained. The DR action plan should be revised and updated as the program proceeds. Initially, the plan should provide the greatest detail on the earlier activities -- the design information retrieval activities. 3.1.3 DESIGN RECONSTITUTION PROGRAM GOVERNING AND IMPLEMENTING PROCEDURES As an outgrowth of the DR action plan, an overall DR program governing procedure should be prepared to provide coordination and integration of the various implementation procedures and implementing organizations. The governing procedure should indicate how the DR program functions are carried out in the various implementing procedures and, thus, how they conform with the DR program plan. Governing procedures in the form of functional flowcharts are helpful in identifying procedural gaps and conflicts between specific implementing procedures.

In contrast with governing procedures, the DR implementing procedures provide detailed instructions for carrying out DR program functions. Development of DR implementing procedures to control technical methods and interfaces should be completed before each activity begins. These procedures should DOE–STD–1073–93 II-66 ensure a consistent approach from source document identification through DIS issuance. They should address and control responsibilities associated with document preparation, review and approval processes, and the long-term maintenance and control of completed documents. They should address the activities necessary to implement the DR program, including the following: • Personnel selection, orientation, and training • Project interfaces (organizational and programmatic) • Project control (schedule and milestones control) • Identification of potential source documents • Technical review of source documents • Verification and technical validation • Discrepancy resolution and open-item management • DIS development (including format and content guide, and layout guide) • DIS review and approval • DIS field validation • DIS maintenance and revision 3.2 IDENTIFICATION AND RETRIEVAL OF DESIGN INFORMATION Identification and retrieval of design information are divisible into two distinct subfunctions: (1) identification and retrieval of the source document that might contain design information and (2) extraction of the design information contained in the identified source documents Each of these subfunctions calls for unique experience and expertise. Identification and retrieval of source documents involves identifying the document types and specific documents that contain design information, locating the documents, and retrieving and cataloging the documents. Extraction of design information presupposes technical expertise in recognizing and classifying various types of such information. Identification and retrieval of design information is accomplished through three phased activities: formal review, smart search, and comprehensive search. These phases correlate with increasing design detail: the formal review concentrates on summary-level design documents; the smart search, the outputs of the design process; and the comprehensive search, the remaining relevant source documents, particularly those establishing the design basis for the design requirements. These phases differ primarily in scope. During each phase, after the source documents are identified and retrieved, the source documents are reviewed to extract the relevant design information, both design requirements and design basis. The approach to design information extraction should be essentially the same, regardless of the source document. The cumulative result of these activities at any stage constitutes the Best Available Design Information. Facilities should identify pilot DR activities to gain experience and to solidify methods. For example, a selected file room could be reviewed initially to identify and retrieve source documents. Then, this effort could be critiqued to improve the methods used before going on and applying the approach to other document locations. Similarly, pilot extraction efforts on selected documents could be useful in refining extraction methods and procedures. Appropriate implementation procedures could be prepared and then tested by pilots to control each activity. Further, where adequate design information is not available, individual facilities may also identify supplementary activities for design reconstitution. For example, facility walkdowns to gather nameplate data could be undertaken, if necessary and beneficial.

Concurrent with DR efforts, the normal design process continues to generate new and revised design requirements and the design basis. These normal design activities also contribute to the Best Available Design Information. Controls should be in place to ensure that ongoing design process efforts and DR DOE–STD–1073–93 II-67 efforts are coordinated. For major design changes, it might prove necessary to accelerate the design reconstitution of associated systems and components. 3.2.1 IDENTIFICATION AND RETRIEVAL OF SOURCE DOCUMENTS Throughout these searches, the document control organization should provide support in locating and retrieving the subject documents. If possible, these search activities should be coordinated with document control activities that identify that organization's design and configuration documents. Documents identified during the searches should be reviewed for inclusion into document control processes and systems, such as the CM document database. A comprehensive index of design documents is a very useful tool until design reconstitution is completed. Figure 3–3 shows the key steps of source document identification and retrieval. 3.2.1.1 Formal Review The formal review of on-hand, summary-level design documents is the first stage of identification and retrieval of existing design information. The scope for this review should be limited to readily available, top-level design documents such as SARs, Technical Safety Requirements, and System Design Descriptions (SDDs), if available, and other top-level synthesis and summary-type design documents. Through document identification and information extraction, the formal review establishes the preliminary set of design requirements and the design basis. For facilities with inadequate design requirements (as determined by the CM program initial assessments or otherwise), the formal review may be needed to support initial development of certain portions of the DR program element (i.e., establishment of the CM equipment database, initial system categorization, and initial system grading) and may be pursued as a priority action within CM program implementation. 3.2.1.2 Smart Search The smart search identifies and retrieves those types of documents most likely to contain design requirements. It culminates in the identification of most of the retrievable design requirements as well as the design basis information contained in the associated source documents. The smart search provides an expedited input to the CM equipment database for use by design and other facility personnel. The documents that are most likely to contain design requirements are the design output documents. These documents include drawings, specifications, load lists, valve lists, operational setpoints, maintenance and test requirements, and construction and installation instructions. Further examples of design output documents are provided in Appendix II–B. Experienced personnel can provide insight into the most likely document types and their locations. Experienced facility personnel might know of facility-specific documents that are not design output documents but are likely to contain design requirements; the smart search should target these documents. While certain design analyses and calculations might contain design requirements, such documents should generally be reviewed during the comprehensive search, which focuses on source documents containing primarily design basis information.

To capture the facility design requirements, the smart search scope may have to include facility documentation that reflects the as-built design. Original design documents are preferred over reconstituted as-built documents but are not always available. Sometimes these reconstituted as-built documents use nameplate rating as the design requirement, lacking better information. This approach presumes that the design is competent and the nameplate rating meets or exceeds the requirements determined by the original design. In most cases, the structures, systems, and components (SSCs) can continue to meet their nameplate ratings and detailed analysis of the original design requirement is DOE–STD–1073–93 II-68 DOE–STD–1073–93 II-69 not necessary. If, however, a test indicated a component (e.g., a pump) could no longer meet its nameplate rating, the design engineering organization would reevaluate the design requirement. Document types may be identified before they are located, as indicated in Figure 3–3. They may also be uncovered by surveying files at storage locations known to contain design documents. The locations can range from vendor files and warehouse storage to individual design engineer files. Many original design documents may be stored in warehouses or other files and not be easy to retrieve. To facilitate document review, it is useful to (1) assign each document a unique identifier to facilitate control and tracking and (2) perform an initial or receipt inspection to ensure that the documents are readable and complete. If the documents are not already indexed as to technical content, facilities should consider indexing them. A document review matrix may be helpful in determining, (I) which document types do not need to be reviewed for design information, (2) which document types should be reviewed, and (3) which document types are expected to contain such information. Each potential source document should be screened to determine if it contains design information and if technical review is necessary to extract that information. Documents related to past missions and past configurations that are no longer valid should be excluded at this point, as should documents related to SSCs that are not included in the CM program. Other specific documents that do not actually provide design information should also be excluded. A second-party review should be conducted to verify that the exclusion of specific documents or document types from further review was warranted. The collected source documents that contain design information should be organized or sorted by system or topical area such that they are readily retrievable for future review needs. Documents thus sorted can be easily directed to the best technical reviewer for the extraction of design information. Sorting may be difficult, as some documents involve many systems and topics. 3.2.1.3 Comprehensive Search The comprehensive search aims at identifying and retrieving the remaining documents that might contain design information, including design analyses and calculations, DOE correspondence, and vendor correspondence. This search identifies mostly design-basis information, but it may serve to capture additional design requirements.

Care should be taken not to limit the extent of the comprehensive search, for its success depends primarily on the identification and location of all source documents containing design information. The comprehensive search team should interview and interact with experienced engineering and operations personnel to locate and collect information, including information stored in desks and personal files. Moreover, they should investigate referenced design documents for potential design basis information. A design output document identified and reviewed in the smart search might contain references to various documents used as the basis for the design requirements it defines; these are good targets for the comprehensive search. Source document types likely to contain design basis information include DOE correspondence, design agency correspondence, vendor correspondence, internal correspondence, meeting minutes, engineering procedures, engineering calculations and analyses, engineering studies and reports, code conformance evaluations, and engineering forms and documentation used to implement designs and design changes. Further examples of design documents are provided in Appendix II–B. In addition to reviewing engineering records, the team should review correspondence files or indexes to identify relevant source documents. Document types that might not need review include press releases, financial reports, and indemnity agreements. DOE–STD–1073–93 II-70 Although they differ in scope, the comprehensive and smart searches should be essentially the same in terms of their methods of document identification and retrieval (see Figure 3–3). Of course, the methodology for document screening, labeling, and sorting developed for the smart search may be refined for the comprehensive search on the basis of lessons learned. 3.2.2 EXTRACTION OF DESIGN INFORMATION After the source documents are identified, retrieved, cataloged, and sorted, they are reviewed to extract the design information they contain. The documents should be directed to the technical reviewers who have expertise in the systems and disciplines reviewed. If documents are sorted incorrectly, the technical reviewer should relabel them and direct them to the appropriate reviewer. The technical reviewer should handle each assigned document only once, for this Is the most efficient and effective approach to extracting design information. For each document reviewed, the technical reviewer identifies and differentiates design requirements and design basis Information. Extracted design information is also identified as to the applicable facility SSCs, types of SSCs, and technical topic area. Categorizing design requirements by type may also be performed efficiently during the technical extraction process. Differentiating the various design requirement types should be easiest during the review of source documents. Often, source documents merely state design attributes that are not requirements of the design process; that is, they are not safety, environmental, or mission design requirements. Incorrectly classifying these design attributes as primary design requirement types can impose undue constraints on engineering activities in connection with design changes or other evaluations.

Different methods of extracting the design requirements and design basis information are acceptable. The reviewer may enter the information directly into a holding database, computer or otherwise, for storage prior to verification and technical validation. Alternatively, the reviewer may highlight the information for a clerk to enter into a holding database. The former approach allows for some summarizing or paraphrasing of design document words to capture their intent exactly, but it involves more of the reviewer's time. Whichever method is chosen, to ensure its effectiveness, the appropriate procedures and training should be provided. The following actions promote the successful extraction of design information: • Select a small, dedicated group of personnel. • Select personnel with facility experience and familiarity. • Provide clear written procedures. • Provide thorough training. • Provide a standard list of SSCs. • Provide standard definitions of design basis and design requirements. • Provide extensive examples of design basis and design requirements. • Provide standard definitions and examples to differentiate design requirement types. • Use checklists. • Maintain focus on the format and contents of the final products. • Maintain strong controls on DR information databases. 3.3 EVALUATION, VERIFICATION, AND VALIDATION OF DESIGN INFORMATION The objective of the evaluation function is to determine whether retrieved design information is accurate and complete. This function includes verification of the extraction process; technical validation of the DOE–STD–1073–93 II-71 extracted design information; and technical management review, which includes the identification of any missing design information. A flowchart of these activities is presented as Figure 3–4. 3.3.1 VERIFICATION OF DESIGN INFORMATION The design information extracted during each identification and retrieval phase (i.e., formal review, smart search, and comprehensive search) should be verified. Proper verification entails checks to ensure that the extracted information is accurate and that no design information was overlooked. Verification should be performed by someone other than the individual who extracted the design information from the source document. It may be performed more efficiently by reviewing the source document along with the extracted design information. Independent extraction and comparison of results are not necessary. Verification should be performed shortly after each source document is technically reviewed to extract design information. Verification can reveal discrete errors and omissions and provide feedback conducive to improvement of extraction methods and personnel performance. 3.3.2 TECHNICAL VALIDATION OF DESIGN INFORMATION Technical validation differs from verification performed earlier; it is an independent technical review that exceeds the quality check accomplished by verification. Technical validation ensures that the retrieved information is technically appropriate and correct; this includes the assumptions on which such information is based and the methods by which it was produced. On a sample basis, consideration should be given to whether the design information is appropriate for the current design arid physical configuration. Critical calculations and analyses should be validated by performing them independently and by different methods. Priority should be given to equipment that supports accident prevention and mitigation and to those design documents for which the accuracy of the original calculations and analyses is suspect.

Technical information developed before formal QA requirements were established may be considered valid if it is labeled, legible, logical, and pertinent to the current physical configuration. Any open items or discrepancies should be identified for evaluation through the DR program discrepancy resolution process. Technical validation should be performed by technically competent individuals familiar with the facility design and the design process. The same individuals involved in extraction and verification may perform the technical validation; however, the validation activity should be clearly separated from the extraction and verification activities. Unlike verification activities, technical validation is most efficiently performed on small batches of system-specific or topical design information rather than on source documents as a whole. Validation should take place at regular intervals (e.g., once a month or once a quarter) or after a defined set of documents have been reviewed. The benefits of validating information in batches are that efficiency is gained by validating many pieces of design information together on a single system or topic and that effectiveness of the validation can be improved by the insights gathered from accompanying information. On the other hand, as technical validation is the last step before release of extracted design information, it should be scheduled so as to provide for the timely release of results. 3.3.3 RELEASE OF VERIFIED AND VALIDATED DESIGN INFORMATION After the design information is technically validated, it should be added to the CM equipment database for use in supporting ongoing design and operations activities. This step is crucial to making the results Yes Prepare Rev. 0 Design Information Summaries Consider Candidate for Regeneration; Regenerate Critical Missing Design Information DOE–STD–1073–93 II-72 DOE–STD–1073–93 II-73 of the DR program available for use, as it occurs long before the preparation and issuance of DISs. Adding only validated design information to the CM equipment database ensures that the database remains a credible source of design information. Timely release of the extracted design information depends on the timely verification and validation thereof. The verified and validated design requirements should be reviewed for impact on system and component grading when entering them into the CM equipment database. As information is entered into the database, ft may be found that different pieces of validated information are in conflict. If so, an open item or discrepancy should be identified for evaluation through the DR program discrepancy resolution process. Until the Item is resolved, the associated data entries should be removed from the CM equipment database because their validity is in question. Reconstituted design requirements should be released and forwarded through the established change control and document control processes exactly as they would be if they were new requirements. This is necessary to ensure that the physical configuration and, particularly, the facility documentation accurately reflect these requirements. One approach would be to group reconstituted design requirements by system at various stages of reconstitution and provide them to other organizations so that they could make necessary changes in configuration documents under their control. Treating the issuance of reconstituted design requirements with controls similar to those for new designs should instill the necessary discipline into the information release process. Each affected organization would acknowledge receipt of the reconstituted design requirements and the incorporation thereof into their documents. Any open items would be identified and resolved at that time. Similarly, open items identified in walkdowns or record searches would be reconciled with the design requirements. In this manner, the reconstituted design requirements would be reconciled with the physical configuration and the facility documents long before the DIS field validation, which is the final check.

Design basis information need not be released in this manner, however, because the physical configuration and facility documents reflect the design requirements, not the design basis. Validated design basis information should be released and reviewed within the design authority and supporting design organizations to ensure that design documents are consistent. 3.3.4 CORRELATION OF DESIGN BASIS TO DESIGN REQUIREMENTS The validated design basis information is examined against the facility design requirements to establish a one-for-one correlation and to expose any incompleteness in the retrieved requirements and basis. Where the design basis is incomplete or nonexistent, the missing information should be noted. The CM equipment database, which relates the facility SSCs and design requirements, should be used to support this correlation. 3.3.5 TECHNICAL MANAGEMENT REVIEW OF DESIGN INFORMATION After technical validation and correlation, a technical management review similar to that conducted initially in the design requirements element should be used to evaluate both completeness and validity of the extracted design information. The review should independently assess the previous technical validation efforts and determine whether additional technical validation activities are needed. It should also determine whether any design information is missing and identify the missing design information. Missing and inaccurate design information will be candidates for regeneration. The need for additional, detailed technical validation is to be expected for critical design information. In determining whether further technical validation is needed, the following should be considered: the status of the original design and construction documents, their importance to facility safety and mission, the extent or frequency of post-construction changes, the effectiveness of the facility modification DOE–STD–1073–93 II-74 control program, the number and nature of reportable events, and deficiencies and conflicts uncovered in using design documents. Completeness reviews should be conducted by system or topic. For each system or topic, the full set of extracted, verified, and validated design requirements or design basis should be collected and evaluated as a unit. Evaluation of these sets of information is a direct precursor to DIS preparation. Several different approaches are possible for determining the completeness of design information, as described in Section 2.2.1.3. The technical management review is the recommended approach to completing evaluation of the extracted information because of the breadth and depth of experience that can be applied and because of the independence of the review from the initial extraction, verification, and technical validation. The review process should be procedurally established, taking into consideration any lessons learned from the initial technical management review employed for the CM program design requirements element. The technical management review of design requirements may begin upon the completion of the smart search, which concentrates on the source documents most likely to contain design requirements, and may proceed in parallel with the comprehensive search, which focuses on documents containing design basis information and, thus, is not expected to yield many new design requirements. This review is conducted before the design basis review so that the initial DISs can be issued and candidate design requirements for regeneration can be determined as promptly as possible. Technical management review of design basis information should be initiated following completion of the comprehensive search. The processes for the design requirements and design basis reviews should be essentially the same, even though the reviews can occur at different times.

Following the management review and completion and approval of any additional actions,, the design information is ready for formatting and initial DIS issuance. The final validation activity, field validation, occurs following the regeneration of critical missing design information and the preparation of DISs. 3.4 RESOLUTION OF DISCREPANCIES The program criteria establish that a formal discrepancy resolution process should be defined and used to support the DR program. The discrepancy resolution process interfaces with existing facility programs, as indicated in Figure 3–5. Open items should be identified to expose unanswered technical questions, concerns, and cases of missing or inaccurate information. Open items will arise from documentation conflicts; undocumented verifications and validations; and undocumented design inputs, constraints, calculations, and analyses. The validity of items should be confirmed; if an open item is not valid, it should be closed. Open items may be identified at any point in the design reconstitution process, from information retrieval to field validation. Strong interaction is to be expected between the design information evaluation function (i.e., verification, validation, and technical management review) and the discrepancy resolution function, because the evaluation function concentrates on the accuracy and completeness of the extracted design information. Open items with safety significance should be identified as discrepancies. Preliminary safety-- significance screening of discrepancies includes an assessment of TSR, SAR, and DOE commitment impacts. If any such impacts are identified, the discrepancy should be evaluated for operability and reportability impacts. Safety-significant discrepancies are to be promptly transferred to existing problem resolution programs, such as those for nonconformance reporting, to determine if any immediate action is necessary. Existing programs are appropriate for operability and reportability reviews because they are specifically designed to accommodate such reviews and they command the necessary experience DOE–STD–1073–93 II-75 DOE–STD–1073–93 II-76 and expertise. Operability and reportability reviews should be performed according to standard procedures. Underlying all DR program activities is the presumption of system and component operability unless, and until, there is confirmed information to the contrary. The presumption of operability is reasonable where broad engineering experience and judgment indicate that an affected system or component is functional, even if sufficient information is not available to make and fully document the final decision on a particular discrepancy. Under the presumption of operability, the information necessary to make a clear determination should be obtained or developed expeditiously and should be acted on thereafter. This approach satisfies the need to operate facilities conservatively by limiting the potential for unnecessary challenges to facility safety systems and personnel. The presumption of operability is not intended as a means of deferring actions necessary to address discrepancies; if a discrepancy clearly affects the safety of facility operation, action to place the facility In a safe condition has to be taken.

Each open item is evaluated and disposed of within the DR program in a manner that supports the program deliverables and schedule. The order of resolution should be based on importance and potential impact. The discrepancy resolution program should track each open item and discrepancy through to completion and closeout. Resolution of open items and discrepancies includes documenting the final disposition. Items directed to existing issue management programs should be tracked to ensure that resolution is complete. 3.5 REGENERATION OF MISSING CRITICAL DESIGN INFORMATION The technical management review determines what design information is missing and which items of missing information will be regenerated. Missing information that is critical to design or operation should be regenerated. The order of regeneration activities should be based on their importance. Regeneration of the design requirements should begin before regeneration of the design basis to provide a complete and accurate set of design requirements as promptly as possible. Regeneration of design requirements is a high priority because the physical configuration is established by, and should be consistent with, the requirements. The processes for design requirements and design basis regeneration should be similar. Regeneration of design requirements may begin after the evaluation of design requirements and proceed in parallel with the completion of the comprehensive search. Regeneration of design basis information should be initiated after the comprehensive search and the evaluation of design basis information to identify missing information. Design basis regeneration is not needed for initial DIS issuance, but it may occur in parallel with the preparation of the initial DISs. 3.5.1 REGENERATION OF DESIGN REQUIREMENTS The missing design requirements may include requirements of each type (e.g., safety, environmental, mission) for SSCs of each grade (e.g., safety, environmental, mission). If missing design requirements were fully regenerated, each type of requirement for each grade of SSC would be regenerated. Full regeneration of design requirements may be appropriate for the most important grades of SSCs (such as safety and environmental), but not for every SSC. Facilities should consider the missing design requirements for a given system or topic, determine which requirements are critical, and prioritize the associated regeneration activities. Regeneration of design requirements for SSCs that support the accident analyses or TSRs should receive highest priority. DOE–STD–1073–93 II-77 Second priority should be given to those design requirements necessary for facility operations, such as set point data. Two options exist for prioritization of remaining regeneration activities: (1) prioritize by requirement type- safety requirements, followed by environmental requirements, and so on; or (2) prioritize by grade (importance) of the SSCs involved. If option 2 is indicated, missing design requirements of every type would be regenerated first for the most important SSCs (i.e., safety and then environmental SSCs). Other possible bases for prioritization include modification history, future plans for modification, and design pedigree. Several methods have proven successful for reestablishing missing design requirements:

• Performing reanalysis. This approach is basically equivalent to redesign; it applies the design process to determine design requirements. Although the most technically acceptable method for regenerating missing requirements, it is typically the most expensive. This approach should be used for the most important missing design requirements. • Gathering and documenting information from the experience of knowledgeable engineering and operations personnel. Their memory is a valuable (and frequently undocumented) source of information, and that information could be lost through attrition, transfers, retirement and death. This activity should start promptly to prevent any further loss of knowledge. • Reenacting the original design process to decide which design outputs or portions of the equipment specifications are essential and which are optional. A combination of the first two approaches, this method may not go as far as reanalysis, but does carefully consider the likely design inputs, constraints, analysis and calculations, and outputs. After reanalysis, this is the most technically acceptable method. • Testing equipment to determine its current functionality and accepting the results as design requirements after a technical evaluation by the engineering organization. Testing might be the only practical method for showing that system performance remains adequate. Reenacting the original design process calls for envisioning that original process. Hypothetically, after having established the fundamentals of the system design, the designer could discuss options with various component vendors. At the beginning of such a discussion, the designer might explain the general application and the functional requirements for the system. Attention would focus on a particular component, such as a valve, and the designer would explain what the valve needed to be able to do. For example, during normal facility operation, the valve has to remain closed to provide intersystem isolation with minimum leakage. During accident conditions, the valve has to stroke open against a differential pressure as high as 500 psid and be fully open within 10 seconds. For failure considerations, the valve has to fail in its as-is position. In response, the vendor might suggest a certain valve for the application. Through an iterative process, the designer and vendor would arrive at the final selection. Recreating this type of hypothetical discussion and capturing the pertinent points is part of reenacting the original design process. The selection of regeneration method is based on available information, the importance of the SSCs, feasibility, and resources. A combination of methods is often a cost-effective approach. Throughout design requirements regeneration, the design basis resulting from the regeneration efforts should be documented. After regeneration, a management review should be conducted to approve the completed set of requirements. As with the other stages, the regenerated design requirements feed to the CM equipment database and might affect system and component grading. Design requirements DOE–STD–1073–93 II-78 regeneration completes the reconstitution of the existing design requirements. Where certain design requirements are not regenerated, the missing design requirements should be noted for listing in the DIS. 3.5.2 REGENERATION OF DESIGN BASIS

The technical management review will also identify missing design basis that are candidates for regeneration. Similar to the review of missing design requirements, facilities should consider the missing design basis for a given system or topic, determine which are critical, and prioritize the associated regeneration activities. Regeneration is not needed for all missing design basis. The DR program should establish the priority and the time frame for regeneration activities. Highest priority should be given to regeneration of the design basis for SSCs that support the accident analyses or TSRs. Further prioritization may be based on the following factors: associated design requirement type (e.g., safety, environmental), associated SSC importance, modification history, future plans for modification, and design pedigree. The basic methods of regeneration (reanalysis, documented experience, reenactment, and testing) of design requirements apply also to the design basis. After regeneration of design requirements, a management review should be conducted to approve the completed set of design basis information. 3.6 PREPARATION AND ISSUANCE OF DESIGN INFORMATION SUMMARIES The DR program results in complete, verified, and validated DISs. The specific scope of system and topical DISs to be prepared is defined by the DR program plan. 3.6.1 PILOT DESIGN INFORMATION SUMMARY PROGRAM A pilot DIS program should be performed before proceeding with the full-scale DIS program. This allows for testing the adequacy of program procedures to ensure the development of consistent products and the satisfaction of program goals and objectives before the start of full-scale DIS production and further expenditure of resources. This pilot effort should focus on DIS preparation and review, including DIS format, contents, and layout. The pilot DIS program should include both system-level DISs and a topical DIS. One of the system DISs should be for a safety system. The DISs prepared during the pilot program may be used as a starting point or as-is for the associated Revision 0 DISs prepared in the full-scale DIS program. The DIS pilot program may begin before completion of the retrieval of available design basis information (i.e., before completion of the comprehensive search) and before completion of the design requirements regeneration. For the pilot program, the completeness of design information is not as important as the process and its effectiveness. At the conclusion of the pilot program, lessons learned should be identified and incorporated into the DR action plan and procedures. 3.6.2 DESIGN INFORMATION SUMMARY FORMAT AND CONTENT GUIDE The contents, format, and style of the DISs will have a great impact on their usefulness and, therefore, their cost-effectiveness. To ensure that the DISs meet their intent, DIS preparation guidance should be provided for writers and reviewers. The DIS Format and Content Guide should specify DIS contents and explain what is to be included in each section. DOE–STD–1073–93 II-79 As defined in the program criteria, DISs should include the following information: • System description (including system interface information) • System operability requirements • System-level design requirements • Component-level design requirements • Design basis • Related design topical information

The DIS Format and Content Guide should define the level of detail of the technical content. It should also define the general format and approach and should include guidance on technical writing and style. Further guidance on DIS format and content is provided in Appendix II–D. Design Information Summaries should be written for a variety of users and experience levels. The DR action plan should have identified the end users and end uses. Users will range from operations, maintenance, testing, procurement, training, and QA personnel to design engineers. Design information Summaries should be tailored to meet individual facility needs and constraints, making use of existing programs and results. The level of detail should reflect program objectives and end uses. To avoid reliance on current experience levels, DISs should be written for a hypothetical 3–year engineer. Such an engineer (or scientist) would have a general facility background, would know the facility layout, and would know the general actions the system has to perform. This approach defines an appropriate DIS content without getting into unnecessary details and explanations. For DISs, a mixed approach is preferable to comprehensive or index approaches. The index approach involves minimal text and extensive lists of references. This approach collates the design information and provides a road map for a prospective user. The comprehensive approach involves text material and copies of actual design documents such as procurement specifications, with a minimum of references. The mixed approach is a balance between the index approach and the comprehensive approach and provides the most useful and cost-effective DISs. The mixed approach makes significant use of text material but references key supporting design process documents. The text includes system descriptions and drawings, operability requirements, system functions, component information, system and component design basis, regulatory requirements, and DOE commitments. Referenced documents include calculations and analyses, codes and standards, design practices, procurement specifications, and TSRs. It is unnecessary to duplicate the content of other self-contained documents such as American Society of Mechanical Engineers (ASME) code stress reports, equipment qualification data packages, vendor manuals, operations and maintenance procedures, industry codes and standards, specifications, generic regulatory requirements, and calculations. References should be to design process documents (e.g., calculations, analyses) rather than facility operating and maintenance documents or secondary facility configuration documentation. The original information should be referenced whenever possible to avoid translation and interpretation errors. 3.6.3 DESIGN INFORMATION SUMMARY LAYOUT GUIDE A DIS Layout Guide, separate from the DIS Format and Content Guide, should be prepared to ensure consistency in document layout and word processing conventions. Such a guide would contain instructions on margins, spacing, numbering, and other issues of particular benefit to DIS word processors and editors. The DIS Layout Guide should clearly distinguish between design requirements DOE–STD–1073–93 II-80 and the design basis, the authorization basis and other design basis information, and the various types of design requirements. 3.6.4 DESIGN INFORMATION SUMMARY USERS' GUIDE

Facilities also should prepare a DIS Users' Guide. In addition to a discussion of DIS format and content, the guide would contain background on the design process, definitions of key terms, a discussion of DIS development and intended uses, descriptions of methods for reporting erroneous or discrepant DIS information and methods for modifying and updating design requirements and basis, and additional references. As appropriate, the DIS Users' Guide would provide guidance on other sources of design information (which might be referenced by the DISs); on how and where such information is stored, and how to access and use it; and on the limitations of its use. The DIS Users' Guide would provide for the most effective use of the DISs produced. 3.6.5 FINAL VERIFICATION OF DESIGN INFORMATION SUMMARIES A final check should be made to verify that the information contained in each DIS has been accurately translated and transcribed during the DIS preparation process. This verification should ensure that any remaining open items are identified correctly and completely. Verification checklists should be used to promote consistency, identify areas for review, provide stimuli for additional questions, and document the verification. Independent reviewers should have sufficient technical background and experience to provide an objective, credible verfification of the DIS information. 3.6.6 ISSUANCE OF DESIGN INFORMATION SUMMARIES Design Information Summaries are issued in at least two major stages: the initial issuance (Revision 0) and the first major revision (Revision 1). It is recognized that Revision 0 may be updated or revised before Revision 1 is issued. Revision 0 contains the complete, accurate, and technically validated design requirements, original and regenerated. It also includes the available, technically validated design basis information, correlated with the design requirements. Any open items are identified. Issuance of DIS Revision 0 provides for the early availability of quality design information. After the remaining DR program activities are completed, the DIS is revised (Revision 1) to incorporate the regenerated design basis and the results of the field validation. Issuance of Revision I culminates the DR program. The technical management review of extracted, verified, technically validated design information may be performed effectively using draft Revision 0. Design information in the DIS format may be best suited to review for technical validity and evaluation for completeness. Design Information Summaries should be issued as controlled documents in accordance with the document control program. Review and approval of the DISs, Revisions 0 and 1, should include interdisciplinary review within the design engineering organization, as well as appropriate interdepartmental review-by operations, maintenance, systems engineering, and other affected organizations. These DIS reviews should establish that the DIS information is correct and that the organization's documents are consistent with the DIS. 3.6.7 FIELD VALIDATION OF DESIGN INFORMATION SUMMARIES Field validation is completed before the issuance of DIS Revision 1. Field validation ensures that design requirements are properly reflected in the physical configuration and in the associated documentation. It also tests the strength of the bonds in the basic CM program model (i.e., among design requirements, the physical configuration, and the configuration documentation). Design basis information cannot be field-validated because its physical configuration and its documentation reflect

DOE–STD–1073–93 II-81 the design requirements, not the basis for the requirements. Thus, field validation concentrates almost exclusively on the design requirements. Design basis may be referred to for the resolution of open items and conflicts between the design requirements and either the physical configuration or the facility documentation. Field validation is done on DISs rather than on raw design information for the following reasons: the design requirements are fully reconstituted, complete, and accurate; sufficient time has been allowed for reconstituted design requirements to be reflected in the physical configuration and configuration documents; design basis reconstitution represents an extra validation of the design requirements; the DIS is a user-friendly compilation of the design requirements, sorted by system and topic and differentiated by type; and DIS issuance is the final step in overall CM program development. With the issuance of DIS Revision 1, the facility needs to be confident that the DISs are complete and accurate and that the CM program basic relationships are established. From this point on, the CM program focuses primarily on maintaining these relationships. Field validation does not take the place of initial reconcilement of design requirements, physical configuration, and configuration documentation. As design requirements are reconstituted, they should be released and forwarded through the established change control and document control processes. Open items and discrepancies identified as the reconstituted design requirements are released should be resolved long before field validation. Field validation is the final check that everything is consistent. Every DIS should have some degree of field validation. The first several should receive full validation, similar to a vertical-slice assessment. Reduced-scope field validations may be acceptable for later DISs if the results of the initial validations are positive. Section 2.5 provides guidance on the performance of vertical-slice assessments and DIS field validation. 3.6.8 MAINTENANCE AND CONTROL OF DESIGN INFORMATION SUMMARIES The DR program should establish the DIS maintenance and control procedures. Once the DISs are complete and the maintenance and control procedures are in place, maintenance and control of the reconstituted design information are integrated into the normal CM program work activities. The design requirements element is responsible for establishment and maintenance of the design requirements and design basis; the document control element, for the control of documents within the CM program. Typically, the design authority would be assigned ownership of the DISs that are to be controlled in accordance with CM document control element. Thus, the design authority would ensure both that the design information is current and accurate and that the DIS is current and accurate. Maintenance and control are necessary to ensure that the DISs retain their value as a reference tool for facility activities. Document controls applicable to DISs should be comparable to those for the SAR. Supporting information, computer software, and other DIS references should also be appropriately controlled.

Examples of appropriate controls would include publishing notices of page changes, updating the databases at the time of such changes, and incorporating the changes annually into the DISs. (if the number or complexity of outstanding change notices were significant, incorporation into the DISs would be accelerated.) The DISs should be reviewed and reissued (e.g., every 2 to 5 years on a staggered schedule, and more often for highly modified and safety-significant DISs) to ensure that they continue to meet facility needs and do not become obsolete. Ready availability to users is essential for the DISs. Facilities should consider establishing information systems featuring centralized information control and user access from convenient terminals. The most effective information retrieval systems have the following attributes: convenient locations, simple DOE–STD–1073–93 II-82 identification of information sources, quick and simple retrieval of information, users guides, and training for potential users. The integration of complete, validated DISs into the normal design control, change control, and document control programs marks the completion of the DR program. 3.7 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN RECONSTITUTION The DR adjunct program is the portion of the CM program most amenable to the graded approach. The primary consideration for adjusting implementation is the SSC grade. The following DR program activities may be adjusted in terms of SSC grades: design information searches (i.e., formal review, smart search, and comprehensive search), regeneration of design requirements, preparation of design information summaries, and regeneration of the design basis. The following matrix shows adjustments to implementation based on the SSC grades. GRADED APPROACH TO DESIGN RECONSTITUTION ACTIVITIES System Formal Smart Comprehensive Regeneration of Preparation of Regeneration of Grade Review Search Search Design DISs Design Basis Requirements 1 Necessary Necessary Necessary Necessary Necessary Necessary 2 Necessary Necessary Recommended Recommended Recommended Recommended 3 Necessary Necessary Recommended Optional Optional Optional 4 Necessary Recommended Optional Optional Optional Optional Application of this matrix is based on system grade, not on the grade for individual components. The entry "Necessary" for the comprehensive search, for example, means that all design information and design requirements for a system of grade 1, and for the components of that system, would be retrieved during such a search. The numerical values shown in the table for the system grades are illustrative; system grade 1, for example, could encompass safety systems. This matrix applies to the case in which the system grade is being applied directly to CM program general criteria; no other graded-approach considerations (e.g., facility technical type, remaining facility lifetime) have been applied. With the application of other graded-approach considerations, the implementation level could be adjusted further, and this matrix would then serve as an example of relative priorities. However, the minimum design information regenerated should be that necessary to support the facility accident analysis and TSRs. The DR program activities related to reconstitution of design requirements (i.e., formal review, smart search, comprehensive search, and requirements regeneration) should be such as to ensure that the desired/remaining facility lifetime equals or exceeds the time involved in those activities. Thus, if the

DOE–STD–1073–93 II-83 remaining facility lifetime is 5 years or more, the full design requirements reconstitution should be implemented; if the remaining facility lifetime is less than 5 years, the searches should be reduced. Retrieving and regenerating safety requirements should have top priority. This guideline is warranted because of the fundamental importance of design requirements to facility operations. Design requirements reconstitution will contribute substantially to a better understanding of the important aspects of facility SSCs, and thus will have a positive impact on operating procedures, training programs, and maintenance programs. Moreover, the activities involved In the development of DISs enable them to remain in use for a period of facility operation equal to or greater than the period estimated for their development. For example, if the desired/remaining facility lifetime is 10 years, an adjusted DR program that can be accomplished In 5 years is appropriate. In adjusted DR program activities, safety SSCs and safety requirements should receive top priority. Additional discussion of approaches and methods to developing adjusted DR program is provided below. For facilities that are currently operating and expect lo continue operating for a significant period, it would not be appropriate to adjust the general program criteria according to operational status. Operating facilities that have been directed to change their operational status within the near future should consider the impact of the change on their program scope. For example, a facility that will enter standby status in I or 2 years may be able to provide a technical basis for conducting only a smart search for safety systems and refraining from the regeneration of missing design requirements. For facilities that are in standby status (i.e., not operating but maintaining the ability to operate), DR program planning is appropriate, but further implementation activity should be withheld pending the announcement of plans to resume operations. Facilities in shutdown status (i.e., not operating and not maintaining any ability to resume operations) should forgo DR adjunct activities altogether. Facilities in the design and construction phases of their life-cycle should take steps to ensure that complete and accurate design requirements, design basis, and as-built drawings are established prior to turnover and operation, so that no design reconstitution will be needed after turnover. Special emphasis should be placed on accelerated completion of DISs. Clearly, the most complete, accurate, and cost-effective approach is to establish the facility design requirements and design basis in the design and construction phase and maintain them throughout the operational phase. Facilities in the major renovation and redesign phase should accelerate DR reconstitution, establishing firm milestones. For example, completing the smart search might be appropriate before returning to the nominal operational phase. For facilities in the deactivation phase, no actions are necessary to reconstitute design requirements or basis. Where facility importance or other considerations (particularly remaining facility lifetime) call for an adjusted DR program, the following adjustment strategies may be considered: • Perform only the most important system and topical DISs. If the DR program scope has to be limited, it might be best to complete DISs for the most important systems only.

• Provide the design basis only for safety requirements. For a program of limited scope, emphasis should be placed on the most important design basis. This option call be used in conjunction with the option above. • Reduce the scope of searches in favor of regeneration. The program might be adjusted to provide for skipping or limiting searches, particularly the comprehensive search, in favor of an aggressive regeneration program. It may be more cost-effective to go ahead with the regeneration without pursuing every possible source of existing design information. DOE–STD–1073–93 II-84 • Limit the technical management review. For a program of adjusted scope, a full technical management review might not be worthwhile. An effort to identify primarily missing design requirements might be appropriate. • Do not regenerate missing design basis. The effort might be limited to collecting retrieved design basis information -- that is, forgoing the identification or regeneration of missing basis. • Adopt short-cuts regeneration. It might be appropriate to adjust the level and depth of regeneration efforts. • Use an index approach for DIS. The use of an index approach rather than a mixed approach might mean savings in time and expense and still be adequate for the remaining lifetime. • Include essential DIS contents only. At a minimum, the DISs should define the conditions necessary to determine the operability of the facility SSCs. These strategies may be used alone or in combination depending on the scope of the adjustment. Other strategies may be adopted in response to individual needs and circumstances. The basis for the scope of the DR program should be established in the program plan. DOE–STD–1073–93 II-85 CHAPTER 4 IMPLEMENTATION GUIDANCE FOR MATERIAL CONDITION AND AGING MANAGEMENT This guidance is appropriate for high-hazard facilities expected to operate for an extended period. Since DOE facilities vary in hazard level and circumstances of operation, a graded approach to implementation should be adopted. As shown in Figure 4–1, Material Condition and Aging Management (MCA) activities are developed and implemented in three distinct phases: a preliminary phase, a detailed or main phase, and an ongoing phase. The preliminary MCA phase includes activities necessary to estimate the facility remaining lifetime and to develop the MCA program plan. The detailed MCA phase builds on the preliminary estimate of facility remaining lifetime with more rigorous evaluations of aging degradation mechanisms to determine more precisely the remaining lifetime. The detailed MCA phase also identifies life extension techniques, if the facility desired lifetime is greater than the remaining lifetime. The ongoing MCA phase identifies degradation measurements to be performed periodically for life-limiting components, performs trending analyses on the results of those measurements to predict the end of life, and implements any necessary life extension techniques. The results of the MCA activities are reviewed by the design authority to determine whether there are new design requirements that should be integrated into the ongoing configuration management (CM) program efforts. 4.1 PRELIMINARY MCA PHASE The preliminary MCA phase has two primary objectives: (1) to develop a preliminary estimate of the facility remaining lifetime and (2) to develop an appropriate MCA program plan. 4.1.1 COMPONENT SCREENING

Some components are so expensive or difficult to replace that their failure may limit the life of the facility. The first activity in the preliminary MCA phase is to screen all components associated with the facility, both active and passive (e.g., structural) components, to identify potentially life-limiting components. They are to be categorized as mission structures, systems, and components (SSCs) if they do not warrant a higher category and are to be addressed in the overall CM program. The first step is to identify all components associated with the facility, both active components and passive components, including structural components. A typical facility may encompass hundreds, even thousands, of individual components. To provide reasonable assurance that all facility components are considered and none are inadvertently overlooked, the preferred approach is to use a Master Equipment List (MEL) if the facility has one. If not, the best available information should be used, such as maintenance records, system design descriptions (if they exist), and engineering drawings. The next step is a review of these facility components by experienced personnel who have a detailed knowledge of the facility and who can identify those components whose failure would have a major cost, safety, or programmatic impact on the facility. This phase of the MCA program excludes components that can be repaired or replaced. After consideration of several hundred components, a small number (perhaps a dozen) are likely to emerge as potentially life-limiting for the facility. DOE–STD–1073–93 II-86 DOE–STD–1073–93 II-87 4.1.2 AGING DEGRADATION MECHANISM EVALUATIONS During the preliminary MCA phase, the major aging degradation mechanisms are identified for each potentially life-limiting component. These mechanisms vary for different types of components, but may include fatigue, corrosion/erosion, stress corrosion cracking, and irradiation. This preliminary evaluation is not intended to be a thorough analysis of all aging stressors, their effects, and failure modes. Rather, it is to be based on available data, initial inspections, and engineering judgment. To provide a basis for an estimate of the facility's remaining lifetime, the current material condition of the components is determined. The aging degradation mechanisms most likely to cause -failure should be emphasized, and any previous aging evaluations that have been performed should be used in this process. Walkdowns may be useful for visually identifying unexpected degradation, and interviews with cognizant personnel from the operations, maintenance, and systems engineering organizations may provide insight into the current material condition of each component. In addition, senior facility personnel who were involved in the construction and initial operation of the facility may be able to provide useful information regarding historical perspectives, operating practices, maintenance practices, and previous findings and conditions. 4.1.3 ESTIMATION OF FACILITY REMAINING LIFETIME The preliminary estimate of a facility's remaining lifetime is not expected to be precise; rather, it should place components in lifetime categories: 0-2 years, 2-5 years, 5-10 years, and more than 1 0 years. Unless better information is available, it should be presumed that the stresses on the potentially life- limiting components involved In operations and operating environments will be the same in the future as in the past.

The estimated remaining lifetime of the facility equals the shortest of the estimated remaining lifetime of the facility's potentially life-limiting components, provided that life extension techniques are not applied. The facility remaining lifetime should be estimated conservatively to compensate for the uncertainties involved. To ensure that users of the estimated remaining lifetime have some understanding of its accuracy limitations, the amount of uncertainty involved in the remaining lifetime should be estimated using engineering judgment. 4.1.4 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS Only in certain situations are the feasibility of continued operations and the feasibility of extended operations addressed during the preliminary MCA phase. The feasibility of continued operations should be addressed when the preliminary estimate of facility remaining lifetime is very short and there may be questions about the advisability of continuing operations at all. The feasibility of extended operations should be addressed (1) when the estimated remaining lifetime is less than the DOE desired lifetime, and (2) when the desired lifetime is comparable to the remaining lifetime, due to the uncertainties expected to be involved in the estimates. These feasibility studies involve (1) identifying management alternatives for continued operations or extended operations, (2) estimating the costs for each alternative as a function of time, and (3) developing recommendations regarding facility continued and extended operations. Management alternatives may include the following: operate the facility until the end of its estimated remaining lifetime; develop and apply facility life extension techniques when the desired lifetime is greater than the estimated remaining lifetime; or place the facility in a standby mode at a specified time, in anticipation of future operations. Cost estimates for each alternative need not be precise, but they should indicate where significant changes in costs would occur. Recommendations regarding continued operations DOE–STD–1073–93 II-88 and extended operations should take into account not only the cost factors, but also the safety and programmatic mission of the facility. 4.1.5 MCA PROGRAM PLAN Although part of the CM program plan, the MCA program plan may be provided separately and should be a stand-alone document. It should be prepared in accordance with directions set forth by the facility CM program to address the topics identified in program criterion 1.3.1.1.c. The amount of useful information available for the MCA program, which includes design requirements and operations/maintenance history Information, will vary significantly. The CM program initial assessments may provide some insight into the availability and quality of existing MCA-type information. The MCA program plan should reflect the availability and quality of this type of information. The MCA program plan should identify programmatic and organizational interfaces with other CM program elements, the facility maintenance program, and the organization responsible for facility design (i.e., the design authority). The programmatic interface with the design requirements program element is particularly important because design life, design operating conditions, and performance, characteristics are specified through design requirements. The organizational interface with the design authority is also particularly important to the MCA program since the products of the MCA, program (e.g., recommended periodic monitoring, revised operating/ environmental conditions, and improved maintenance) are provided to the design authority as proposed new design requirements.

In some cases, the estimated facility remaining lifetime may be substantially longer than the desired lifetime, eliminating the need for additional MCA activities. If proceeding with the MCA program beyond the preliminary phase is not appropriate, the program plan should address those circumstances that define the appropriate level of implementation. 4.2 DETAILED MCA PHASE The detailed or main phase of the MCA program involves the development of an action plan and supporting procedures, final identification of life-limiting components of the facility, final evaluations of aging degradation mechanisms, determination of facility remaining lifetime, identification of life extension techniques, and feasibility of continued operations and extended operations. 4.2.1 MCA ACTION PLAN AND PROCEDURES The contractor should develop an action plan, governing procedures, and implementing procedures, as described in section 2.1.4. 4.2.1.1 MCA Action Plan Within approximately 6 months after DOE review of the MCA program plan, the MCA action plan should be completed. It should identify the program manager and project organization, provide a clear mandate, and have the support of senior management. The contractor should participate directly in the development of the action plan to ensure ownership, knowledge retention, achievement of purpose, and ongoing and effective MCA. All affected parties should concur with the plan. The action plan should describe the review and approval process for project deliverables and should identify end users. Early input and feedback from end users is crucial in the effort to realize the MCA program objectives. The MCA team should include representatives of the end users, as well as DOE–STD–1073–93 II-89 representatives of the engineering, operations, and maintenance departments. Proper selection of the MCA team is vital to success. The collection of information or data and the performance of MCA evaluations will likely be accomplished in several iterations. Information developed or conclusions reached at a given point in the program may invalidate prior information or conclusions, or it may indicate that more detail or additional information is necessary. Data gathering may occur in stages as the aging evaluations indicate the need for more data. Sources of information or data used to support the conclusions should be documented. Initially, the action plan should provide the greatest detail for those activities that need to be completed in the near term. Moreover, the action plan should provide detailed discussions of those activities that have already been completed. The MCA action plan may be revised and updated as the program progresses. 4.2.1.2 MCA Governing and Implementing Procedures The contractor should develop governing and implementing procedures for the MCA adjunct program. Governing procedures serve to indicate the correlation of the action plan with the program plan and to coordinate the implementing procedures with each other and with the action plan. Governing procedures are, in effect, an umbrella document or overview of the implementation process. Development of facility implementing procedures to support the action plan is necessary to ensure a consistent approach to MCA and to promote the successful and cost-effective completion of the MCA program. These procedures should address and control responsibilities associated with the performance of analyses and with the preparation, review, and approval of documents. The procedures should provide specific methods for identification of life-limiting components, detailed aging degradation evaluations, determination of facility remaining lifetime, and feasibility for continued operations or life extension.

4.2.2 FINAL IDENTIFICATION OF LIFE-LIMITING COMPONENTS The final list of life-limiting components should be developed through a structured process based on established criteria and a detailed scoring methodology. This list of components provides the subjects for the detailed MCA analysis. A flow diagram for the identification of life-limiting components is shown in Figure 4–2. The primary activities of this process are: • Screen SSCs to identify components that are potentially life-limiting. • Determine significance to facility lifetime of potentially life-limiting components. • Identify the life-limiting components. Personnel knowledgeable about the facility and its safety analysis should perform the screening of SSCs to identify those components that are potentially life-limiting. These components should meet one or more of the following criteria: • Replacement cost is large. • Replacement schedule is long. • Failure may have significant impact on facility safety. • Known history of safety concern exists. • Operating conditions or environment are relatively harsh. DOE–STD–1073–93 II-90 DOE–STD–1073–93 II-91 Life-limiting components are selected by applying predetermined evaluation criteria to the components that were identified as potentially life-limiting, with each component given a score for each criterion. The evaluation criteria should include consideration of: • Feasibility of replacement •� Replacement schedule, including outage duration (facility downtime) • Replacement cost • Impact on adjacent structures • Disposal and transportation difficulties • Service environments (corrosion/erosion, dynamic loading, radiation, environmental conditions, and synergistic effects) • Safety • Issues that are specific to the facility Each evaluation criterion should be assigned a weighting factor that is applied to its score, with the considerations that are most critical to facility life having the highest weighting factors. The combination of the score and the weighting factor determines the total score for each consideration. The total score for each potentially life-limiting component is the summation of the total scores for each consideration. This scoring is performed for each potentially life-limiting component. Because the score that a component receives for each criterion depends on the knowledge and experience of the scorer, it is recommended that at least two teams perform the evaluations. These teams should consist of individuals who are experienced in the design and operations of the facility and who are supported by personnel trained or experienced with MCA. The teams should work independently during the initial scoring process. Subsequently, representatives from each team should meet to resolve differences and generate a consensus composite score for each component. Once the scoring process has been completed, the final selection criteria for the life-limiting components may be a threshold value for the consensus composite score of a component or some other criterion that appropriately identifies life-limiting components.

Concurrent with this activity, SSCs within the CM program may be screened to identify SSCs that, although not life-limiting, should be reviewed in more detail to evaluate aging. A review of the non-life-- limiting components may indicate that aging management should be adopted as a matter of good practice. If the failure of certain SSCs may have a significant impact on safety or mission, evaluation may be appropriate. Because of the potentially severe impact, it is desirable to avoid failure of some types of equipment. For example, a facility may have so many electrical cables and cable trays that special attention to them is warranted. Similarly, if a facility has several hundred motor-operated valves, this type of equipment may warrant special attention. This SSC review should be coordinated with other programs, such as the maintenance program. 4.2.3 DETAILED AGING DEGRADATION EVALUATIONS The purpose of detailed aging degradation evaluations is twofold: (1) to identify mechanisms that determine the lifetime of components and (2) to provide for observations or measurements that define the condition of life-limiting components. This information is necessary to the final determination of facility remaining lifetime, the feasibility of continued operations, and the definition of the ongoing MCA program. This activity includes performing the following steps for each component: • Develop full description of the component. • Identify significant aging mechanisms. DOE–STD–1073–93 II-92 • ldentify measurements that will monitor significant aging effects. • Make baseline measurements of component material condition. The methodology, depicted In Figure 4–3, provides a model that may be used for both Iife-limiting components and important SSCs that are not life-limiting, but have been selected for detailed MCA analysis. 4.2.3.1 Component Description The description of component parts, environment, and functions should be sufficiently detailed to permit the identification and evaluation of the significant stressors and aging mechanisms. The safety-, environmental-, or mission-related functions and operation of each component should be described in terms of design requirements. Components may have multiple functions that are either active or passive. Each component should be described in a way that makes clear the boundaries between what is being evaluated and what is not being evaluated. For example, the boundaries of a motor- operated valve may be at the welds or flanges that connect it to the piping system, at the electrical breaker that provides the electrical power to the motor operator, and at the connectors for the instrumentation and control circuits. In this case, the connecting piping, the electrical power distribution system, and the instrument and control system are outside the component boundary. Interfaces with other equipment and systems should be described relative to physical, design, and environmental factors. If the component was qualified for its application by special testing or analysis, the specific set of functional requirements and environmental conditions that comprise the qualification of the component should also be described.

Breaking down the component into subcomponents simplifies the task of identifying significant aging mechanisms and failure modes. Subcomponents are generally divided into those that have a similar identifiable importance to the overall function of the component/assembly and those that react to stressors in a similar manner. The breakdown of components into subcomponents often facilitates the aging degradation evaluations. For example, a battery can be divided into subcomponents consisting of the container, the plates, the terminals, and the electrolyte. Each has different aging mechanisms and failure modes. Evaluating each subcomponent separately is easier than evaluating the component as a unit. 4.2.3.2 Identification of Significant Aging Mechanisms For each subcomponent, the stressors and aging mechanisms that could lead to failure should be identified. This process is shown in Figure 4–4. The descriptions of the components make it possible to identify the types of stresses and the materials that are affected by each stress. It is important to identify the degrading effects that the stresses have on the materials to help determine potential failure modes for the equipment. The Nuclear Regulatory Commission (NRC), the commercial nuclear industry, and industry standards organizations have performed a number of aging studies. That provide useful information concerning materials susceptible to aging, the stresses that cause them to degrade, and resulting degradation mechanisms. Examination of the component, its design, its functions, and pertinent aging mechanisms, as well as qualification, performance, maintenance, test, and condition-- monitoring data may provide additional information. For example, excessive temperature is a stress to the insulation of electrical cables that can cause the insulation to become brittle and lose its integrity; the resulting failure modes are shorts to ground and shorts to other electrical circuits. Evaluation of the potential aging stresses and the resulting failure modes that have the most significant effects on facility safety or availability takes into account the severity of the stresses found in the facility and the rate of progression, or aging rate, to identify each aging mechanism. The magnitude of stresses in the facility may already have been measured and documented in facility records, or DOE–STD–1073–93 II-93 DOE–STD–1073–93 II-94 DOE–STD–1073–93 II-95 measurements may be taken specifically for this purpose. Failure modes and effects analyses (FMEAs) performed to support safe operation of the facility may be useful in identifying the failure modes that have the most safety significance. In addition, the selection of ongoing maintenance tasks for the component may have been based on actual experience and similar evaluations of the ways in which significant failures could occur. 4.2.3.3 Identification of Material Condition Measurements Practical measurements should be identified to monitor significant aging effects. As shown in Figure 4–5, the first step is to identify the physical characteristics associated with each significant failure mode and corresponding aging mechanism. The emphasis should be on the physical characteristics associated with stressors and aging mechanisms that have the most significant influence on a failure mode (i.e., component or material properties most affected by the aging mechanism). Material characteristics (e.g., hardness or dimensions) and electrical characteristics (e.g., electrical insulation integrity) are examples of critical physical characteristics.

The next step is to identify the actual parameters to be measured or monitored for detecting the presence and rate of degradation in a critical physical characteristic. To the extent possible, these parameters should be direct measurements or observations of the previously identified critical physical characteristics. A direct measurement is one that measures the actual critical physical characteristic, such as material hardness when material hardness is the critical characteristic. Because some physical characteristics are difficult to measure directly, validated indirect measurements may be necessary. These indirect measurements should encompass characteristics that are as close as possible to the critical physical characteristics. For example, vibration may be an indirect measurement of wear; elasticity, as measured by an elongation test, may be an indication of electrical insulation integrity. Visual observations, such as discoloration caused by heat and corrosion, may also be valid indicators of physical degradation. The observable parameter should have been validated as an accurate indication of the progress of a component or subcomponent to its point of failure. One or more observable parameters should be chosen to monitor each critical physical characteristic. Finally, the measurable and observable parameters for each component are brought together into a list of practical measurements that can be performed to monitor significant aging effects. This list of practical measurements provides the basis for obtaining baseline MCA measurements of component material condition. 4.2.3.4 Baseline Measurements of Component Material Condition Measurements should be made of significant aging effects to determine the current material condition of life-limiting components to establish a baseline for determining the remaining lifetimes. These measurements also form the basis for recommendations regarding periodic material condition monitoring and trending to anticipate the end of lifetime that might be implemented during the ongoing MCA phase. 4.2.4 DETERMINATION OF FACILITY REMAINING LIFETIME The process for determining facility remaining lifetime is shown in Figure 4–6. The first task is to determine the current condition of the component or subcomponents as indicated by the baseline measurements plus the following historical considerations: time in service; usage or operational history; stressor history or, if unavailable, a conservative approximation that bounds expected extremes and maintenance and surveillance history. DOE–STD–1073–93 II-96 DOE–STD–1073–93 II-97 DOE–STD–1073–93 II-98 The next task is to select an appropriate method for estimating the component's remaining lifetime. In some cases, a simple time-in-service approach is sufficient. The remaining lifetime is calculated as the total lifetime of the component less the time that it has already been in service. For example, if the vendor indicates that a component should have a total lifetime of 15 years and that component has already operated at the facility for 11 years, its remaining lifetime is estimated to be 4 years. In other cases, the time-in-service approach is not adequate for estimating the remaining lifetime. It may be necessary to take into account the actual service history (e.g., the number of operating cycles and the stresses associated with each cycle), which may differ from the average service conditions anticipated by the vendor. An approximation of facility remaining lifetime should include consideration of the identified aging mechanisms and one or more of the following:

• Failure rates (mean time to failure) • Comparison to components with similar materials and environmental history • Straight-line projections utilizing current condition and projected degradation rates • The Arrhenius model (applicable to materials that age as a function of the ambient temperature) • Engineering judgment Depending on whether future operations of life-limiting components are expected to have stresses that are similar to, greater than, or less than those experienced in past operations, it may be necessary to modify simple straight-line projections that begin with current condition and apply observed degradation rates to estimate remaining lifetime. Existing data that are useful in arriving at this estimate include operating and maintenance histories, occurrence of severe events that may have significantly stressed the component, industry experience with similar equipment, vendor specifications, and design information. This information may reveal a significant difference between the actual operating conditions and those assumed by the designer or the vendor which may provide the basis for adjusting the expected total life of a component. The remaining lifetime is estimated by subtracting the time-in-service (modified as appropriate through current condition considerations, as discussed) from either qualified life, updated as necessary, or the expected total life. The remaining lifetime of the subcomponents determines the remaining lifetime of the component being assessed. Determination of remaining lifetime should be conservative because of the uncertainties in the estimating process. The determination should take into account factors such as overall confidence level of estimated time to failure and frequency of monitoring the limiting age-related characteristics. The degree of the uncertainty should be estimated and included with the final determination of the remaining lifetime. 4.2.5 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS After the previous conclusions concerning the feasibility of continued operations have been either confirmed or revised, management alternatives similar to those considered in earlier feasibility studies should be considered during the final feasibility study. The costs, as a function of time, of each alternative should be determined and presented. Significant break points in the cost factors should be identified and highlighted. The following cost factors should be considered: • Present operating and maintenance costs (used as a reference for evaluating alternatives) • Costs for continued operations, including those for accommodating both near-term and long- term continued operations, and any costs related to delays in completing the facility mission • Costs to develop and implement facility upgrades needed for life extension • Costs to enter and maintain standby operations, and then to restart the facility • Costs of decommissioning the facility DOE–STD–1073–93 II-99 There is a potential overlap between the feasibility studies conducted in this detailed MCA phase and the activities of the ongoing phase of the MCA program. If DOE has specified a desired lifetime for the facility that is significantly longer than the remaining lifetime, it is necessary to develop life extension techniques. When the need for life extension techniques is clear, they should be developed during this phase, at least to the extent that there is a basis for recommendation for life extension techniques for the ongoing MCA phase, and the costs of development and implementation of those techniques should be estimated and included In the feasibility study (to the extent that the costs of those techniques can be estimated).

Similarly, the feasibility study should include recommendations for periodic MCA monitoring of equipment, based on the measurements of the baseline material conditions used in the aging degradation evaluations, and for trending the results to predict the end of life for life-limiting components. 4.3 LIFE EXTENSION TECHNIQUES Life extension techniques make it possible to operate a component beyond Its normal lifetime. Life extension techniques include actions that reduce stresses, such as operational changes and hardware/facility modifications, and those that reduce the effects of stresses. Generally, life extension techniques are applied only to components that have been determined to be life-limiting for the facility. The development and application of such techniques have associated costs, as estimated during the feasibility study. These costs should not be incurred unless DOE has specifically directed such expenditures or has specified a desired lifetime that is greater than the remaining lifetime of the facility. Environmental stressors, such as temperature and radiation, which are known to induce aging degradation, particularly in non-metallic materials, can be characterized and their impact reduced to extend component life. Collection and evaluation of environmental data can provide the basis for adjustments to environmental conditions, such as by additional thermal insulation, venting of electrical enclosures, HVAC upgrades, the addition of radiation shielding, and periodic decontamination of piping near the equipment. Adjustments in operational practices can extend component life. Such adjustments may include reducing the period of operation, decreasing the number and rate of startups/shutdowns, and optimizing or improving testing practices that contribute to equipment degradation. Upgrading the design can also extend the lifetime. Equipment manufacturers and the commercial nuclear industry develop life-extending design enhancements based on operating experience and the availability of new technology/materials. These include changing to materials more resistant to aging stressors or reconfiguring for improved reliability. For example, during research conducted on electrical inverters, an evaluation of several design configurations demonstrated that the use of an automatic transfer switch improves the reliability of the power supplied to controls and equipment. Other recommended design improvements include the use of higher ratings for voltage- and temperature-- sensitive components in the inverter circuitry, and the addition of forced-air cooling to reduce overheating problems. 4.4 ONGOING MCA PHASE With the completion of the detailed or main MCA phase, the development of the MCA program is essentially complete. The ongoing MCA phase involves simply adapting previously developed MCA actions for incorporation into the ongoing CM program. For example, a one-time measurement method DOE–STD–1073–93 II-100 may be converted to a measurement method practical for repeated application, or life extension techniques needed to achieve the desired lifetime for the facility may be finalized.

Results of activities in earlier MCA phases should be forwarded as recommendations to the design authority for consideration as new design requirements. New design requirements should include actions related to periodic monitoring and trending of aging degradation, as well as actions related to life extension. To support these new design requirements, the aging degradation evaluations should also be provided as design basis. The appropriate line organizations, such as operations, or maintenance, carry out the approved new design requirements on an ongoing basis. For example, slower, stress-reducing operations (e.g., heatups, cooldowns) to extend facility lifetime are implemented through operations procedures. Periodic aging measurements may be performed by either the maintenance or system engineering organizations. For the periodic monitoring, this involves fine-tuning the technical aspects of the periodic measurements for ease of use, error avoidance, and operational efficiency. In addition, it involves establishing appropriate frequencies for monitoring actions for different types of equipment, as well as requirements and methods for trending the results of those measurements and for extrapolating the trend to anticipate end of life. The resulting extrapolated lifetimes should be used to update the previously determined lifetimes. 4.4.1 DEGRADATION TRENDING The purposes of degradation trending are to determine whether the degradations are progressing as expected and to identify corrective actions that may be necessary to achieve the component or facility lifetime. The analysis of data obtained by MCA periodic material condition measurements may show that component degradation is occurring faster or slower than expected. This new information may lead to revisions of the remaining lifetime determination, revising the life extension techniques, or some combination of both. To ensure that the desired facility lifetime is achieved, it is necessary to monitor the components most likely to affect the facility lifetime, the components for which the lifetime is uncertain, and the components that need life extension techniques to achieve the desired facility lifetime. Consideration should also be given to adding measurements that are designed to detect unexpected degradation of the components. Often, it is the unexpected that causes a component to fail before the end of its life. For example, it was discovered in the commercial nuclear industry that thermal stratification of the liquid inside pipes connected to pressurizers can cause stresses in the pipe wall that can lead to failure. Yet, these stresses had not been anticipated in the design process. The final selection of measurements should take into account the significant failure modes, degradation mechanisms that could cause unexpected failures, and the practicality of obtaining these measurements. The baseline measurements of the current condition of included components identify techniques that successfully measured critical physical characteristics and those techniques that did not. The baseline measurements show where improved or alternate measurement techniques are needed.

A list of potential measurements is then developed. These are termed "potential measurements" for two reasons: (1) more measurements may have been identified than are actually necessary (in some cases, the initial baseline results do not warrant repeating the measurements on a periodic basis); or (2) the total number of measurements may not be consistent with the overall capability of the facility for obtaining and analyzing the volume of information that will result from these repeated measurements over the long term. Also, alternative or improved measurement techniques may be identified that have not been previously obtained at the facility. It will be necessary to confirm that these techniques are DOE–STD–1073–93 II-101 consistent with the existing capabilities of the facility or that needed upgrades to the facility's measurement capabilities are feasible. A final list of periodic material condition measurements should be developed based on the results of facility remaining lifetime determination, the previous baseline measurements, and the capabilities of the facility. In addition, consideration should be given to establishing measurement methods that can reasonably be expected to provide consistency and repeatability among different personnel across a period of several years. Various monitoring methods, including continuous monitoring or scheduled inspections, provide periodic material condition measurements that determine current performance or condition. Observed values are then compared with minimum acceptance criteria and with results of previous observations on the same components. Criteria can be established so that corrective action is initiated when monitored parameters deteriorate to a specified level or vary in a specified manner. Equipment monitoring does not always uncover aging degradation. For example, electronic components tend to fail catastrophically at random times, rather than degrading slowly over time in service. For this type of equipment, trending component failure rates may be the only appropriate method of monitoring aging. If sufficient statistical data are available, it is possible to schedule surveillance, preventive maintenance, or replacement more effectively. For example, if the failure pattern of a component shows that the probability of failure increases significantly after a certain time, replacement of equipment may be scheduled. This type of trending entails a systematic collection and analysis of operational data. The recording of equipment deficiencies in a specified, systematic manner makes it possible to determine the severity of failures, failure modes, and root causes of failures, and to monitor trends of failures and their causes. 4.4.2 APPLICATION OF LIFE EXTENSION TECHNIQUES If the need for life extension techniques was apparent at the time of the detailed phase of the MCA program, the feasibility study should have included recommendations for life extension techniques, at least the preliminary development of those techniques, and estimates of the costs involved. That study should be used as the starting point for the ongoing phase of the MCA program. If life extension techniques have not been developed, or a new need for them should arise, they would be developed during the ongoing MCA phase.

During the ongoing phase, the life extension techniques are finalized and established as new requirements. Because these techniques often involve new design requirements, such as operating conditions or operational limitations for equipment, design authority is the appropriate organizational unit to review proposed life extension techniques. The operations organization staff also need to be involved in many situations to develop appropriate practical operating scenarios. In addition, the design authority should coordinate with the maintenance department to determine appropriate actions to be taken with regard to MCA for selected non-life-limiting components. 4.5 SPECIFIC APPLICATION OF GRADED APPROACH: MCA ADJUNCT PROGRAM SSC grades are not significant to the main thrust of the MCA adjunct program. The MCA program is focused on life-limiting components, which can include components of any grade. This approach is necessary to arrive at a viable determination of the facility remaining lifetime. Other graded-approach considerations that are generally applicable to implementation of the MCA program are remaining/ desired lifetime, operational status, and facility life-cycle phase. Remaining/desired lifetime and DOE–STD–1073–93 II-102 operational status generally have the greatest effect on determining the appropriate level of implementation. Depending on these considerations, MCA program implementation may include all the activities that have been described, or only a few. The following matrix illustrates different implementation levels, identified as High, Medium, Low, and Minimal. The primary influence on selection of implementation level is the facility grade. There is, however, a secondary influence that involves the desired and remaining lifetimes. For facilities where the estimated remaining lifetime Is less than the desired lifetime, a high level of implementation is the most appropriate level of implementation. For facilities where the estimated remaining lifetime is about equal to the desired lifetime, a medium or low level of implementation may be appropriate. For facilities where the preliminary estimate of remaining lifetime is significantly greater than the desired lifetime and the facility grade is low, a minimal level may be most appropriate. ,As shown in the matrix, the activities related to estimating the facility remaining lifetime are needed for all facilities, because this input is so important to the overall CM program planning. The matrix applies when no other graded-approach consideration (e.g., facility technical type, operational status) has adjusted the program activities. When other graded-approach considerations indicate that an adjusted MCA program is appropriate, additional options may be used to tailor the MCA program to the facility needs. The matrix then serves as an example of relative importance. DOE–STD–1073–93 II-103 IMPLEMENTATION MATRIX FOR MCA ADJUNCT PROGRAM MCA FUNCTIONS HIGH MEDIUM LOW MINIMAL COMPONENT SCREENING Necessary Necessary Necessary Necessary AGING DEGRADATION Necessary Necessary Necessary Necessary EVALUATIONS ESTIMATION OF FACILITY Necessary Necessary Necessary Necessary REMAINING LIFETIME FEASIBILITY OF CONTINUED OPERATIONS Necessary Necessary Recommended Optional OR EXTENDED OPERATIONS DETAILED MCA ANALYSIS Component Screening Necessary Necessary Recommended Optional Aging Degradation Evaluations Necessary Necessary Recommended Optional

Definition of Physical Characteristics Necessary Necessary Recommended Optional and Measurements Baseline Measurements Necessary Necessary Recommended Optional Facility Remaining Lifetime Determination Necessary Necessary Recommended Optional Feasibility of Continued Operations Necessary Recommended Optional Optional or Extended Operations DEGRADATION TRENDING, AGING MANAGEMENT, AND LIFE EXTENSION Establish Monitoring Requirements Necessary Recommended Optional Optional Trend Data and Update Lifetime Necessary Recommended Optional Optional Determinations Life Extension Techniques As Necessary As Necessary As Necessary As Necessary II-A-1 DOE–STD–1073–93 APPENDIX lI–A DESIGN CONTROL Design controls are the measures established to assure that the design process activities are carried out in a planned, orderly, correct, and documented manner. These controls assure the quality of the design requirements and design basis obtained through the design process. Design controls are constraints to the design process that ensure the following results: the correct identification of design inputs and constraints; the design analysis and calculations are complete and correct; and the design outputs are complete and consistent with the design basis. Design controls are implemented through procedures. DOE 5700.6C, Quality Assurance, defines DOE design control requirements. ANSI/ASME NQA-1, Quality Assurance Requirements for Nuclear Power Plants, provides additional guidance on design control. Examples of design controls include: • Organizational responsibility for design functions • Training and qualification of engineering personnel • Information exchange and interface controls • Controls for preparation, review, approval, release, and revision of design documents • Document controls for maintenance and retention of design documents • Identification of appropriate design inputs and constraints • ldentification of required design output documents • Identification of required changes to facility configuration documents • Determination of quality levels, and acceptance standards • Programs to track cumulative effects of design changes • Design verification reviews • Requirements for and performance of design assurance reviews • Conduct of audits and management reviews • Conduct of corrective action programs Design controls should provide some measure of assurance that proposed changes do not incorporate the same design deficiencies built into the original design, if any exist. The design engineering organization should not blindly accept previous design work as correct. Rather, it should maintain a questioning attitude that considers the credentials, vintage, methods, and assumptions of previous design work. Design controls should call for reasonableness checks of key calculations and assumptions, and other calculations on a sample basis. In cases in which the original design is suspect and in other specified cases, a zero-basis justification should be performed. The zero-basis justification involves a clean sheet approach to critically review or reanalyze the system design requirements to an appropriate interface point. Further, whenever new design requirements are issued for SSCs with incomplete, inadequate, or missing design basis, critical portions of the SSCs' design basis should be re-established at that time.

Programs to track cumulative effects of design changes are important design controls that are sometimes overlooked. Critical load growths should be identified for tracking. If untracked, these load growths might exceed the design capacities or design assumptions. Design verification checklists may be used to track cumulative effects for variable design features such as loads on batteries or emergency diesels, heatloads in equipment rooms, or weight loads on structures, including cable trays. The checklist could identify the need to update the applicable load lists and take other necessary actions. This approach can ensure that the design constraints imposed by previous designs are met. DOE–STD–1073–93 II-A-2 Design control measures should also provide for verifying or checking design adequacy. Such measures would include performance of design reviews, by the use of alternate or simplified calculational methods, or performance of a suitable testing program. The verifying or checking process should be performed by individuals other than those who performed the original design, but who may be from the same organization. Where a test program is used to verify adequacy of a specific design feature in lieu of other verifying or checking processes, it should include suitable qualification testing of a prototype unit under the most adverse design conditions. Other design process controls that facilitate responsive, efficient, and effective design include processing of requests for design changes, root cause determination of facility hardware problems, development and selection of alternate solutions, cost/benefit evaluations of design changes, conceptual design phase, project controls and planning of engineering design process work, and, physical change tracking. These controls might or might not have a direct effect on the quality of the design produced. These types of controls are largely administrative, and while they can be very important to providing a responsive, efficient, and effective design, they are not required design controls. Design Authority vs. Design Agency. One of the more important aspects of design control is the establishment of a single design authority, with defined relationships to the supporting design agencies. The design authority is the organization responsible for establishing the design requirements and ensuring that design output documents accurately reflect the design basis. The design authority is responsible for design control and ultimate technical adequacy of the design process. These responsibilities are applicable whether the process is conducted fully in-house, partially contracted to outside organizations, or fully contracted to outside organizations. The design authority should be a single organization within the owner/operator organization. The design authority may delegate design work, but not its responsibilities. In a CM program context, the design authority assures that the design requirements and design basis are fully identified and in a form compatible with needs. Policies and procedures should clearly identify the design authority. Many facilities have policies and procedures establishing the facility design authority; these should be retained and upgraded, if necessary, to better support the CM program.

The design agency is the organization that performs the design activities, particularly those associated with design analysis and calculations. The design authority can perform as the design agency. Other organizations also can perform as the design agency for design work ranging from a given design to all designs. The design agency performs design activities at the direction of and under the responsibility of the design authority. For example, the organization performing DOE 4700.1 design work is a design agency, but often not the design authority. The design agency should provide the content and format of the design outputs and design basis, as well as the technical adequacy, according to the requirements of the design authority. Design interfaces should be identified and controlled, and design efforts coordinated among and within participating organizations. Interface controls should include the assignment of responsibility and establishment of procedures among participating design organizations. Formal interface controls between the design authority and the design agency are necessary, even for the case where the design agency is within the same corporate organization. In this case, the size of the organization influences the degree of procedural controls necessary; the larger the organization, the greater the need for procedural controls. In large matrixed organizations, support from other groups should be handled formally through specifications, requisitions, and work control. In essence, the design authority treats these matrixed organizations as outside vendors. For both vendor activities and these matrixed organizations, the design authority should establish acceptance criteria to define satisfactory work completion. The program management element provides further direction on programmatic and organizational interfaces, and vendor control. DOE–STD–1073–93 II-A-3 Multi-Tiered Design Process. The design process produces both design requirements and the associated design basis. Changes to design requirements need to be supported by the design basis. The design process identifies, documents, categorizes, and sorts by SSC every new facility design requirement, as well as changes or modifications to existing design requirements. The design process also identifies and documents the design basis of every new facility design requirement, in addition to changes or modifications to existing design requirements. The design process is called upon whenever a change to the facility design requirement is contemplated. Permanent and temporary facility physical changes need engineering design if they involve potential changes to design requirements. Changes to final designs, field changes, facility physical changes, and nonconforming items dispositioned use-as-is or repair should be evaluated, and subject to design control measures commensurate with the original design. Requests for, engineering design may be initiated from within the design organization, and also from non-design organizations, such as operations, maintenance, and technical support.

Design controls may vary based on the complexity and significance of the design change. For example, some commercial nuclear facilities employ a three-tiered design process. Once the design process is initiated, a scope assessment is conducted to determine which tier the design change will take. This assessment reviews the technical complexity, the magnitude of the change, and the potential impact on previous commitments, including the authorization basis. Based on the scope assessment, the engineering management decides which of the three tiers the design task will pursue. These three tiers might be designated: Field Change Notices (for simple drawing changes to reflect as- built conditions); Minor Modification Packages (for minor facility changes such as component re- designs, with minor systems impact or systems interaction, and minor safety significance); and Design Change Packages (for other facility changes). Within DOE, an important distinction is between those changes managed as projects under DOE 4700.1, and those not managed as projects. The facility may also establish separate design control provisions to accommodate those changes to documents only, without any associated physical changes. The specific design control measures to ensure that the design process is correctly implemented may vary depending on which tier is appropriate for a design change. However, regardless of the level of design control applied, the design process needs to produce both new/revised design requirements and associated design basis. The design process is the same at the different levels. Without proper controls, designs performed on the lower tiers often do not produce the necessary design basis and design outputs. The design authority needs to carefully control and monitor each design tier to ensure the design inputs, design constraints, design analysis and calculations, and design requirements are identified, accurate, complete, and documented. DOE–STD–1073–93 II-B-1 APPENDIX II–B EXAMPLES OF DESIGN INFORMATION This appendix provides examples of design documents at various stages of the design process. This illustrates how certain common design documents may be categorized within the design process. The important differentiation demonstrated here is between design requirements (design output documents) and design basis (design inputs, constraints, and analysis and calculations). This appendix also provides examples of both design requirements and design basis, illustrating the relationship between them and demonstrating their differences. The examples show the types of information; they do not constitute complete requirements or basis. Design Input Documents. • Specific functional requirements - Interfacing systems/functions - Safety/quality class - Load purpose/function - Load sequence - Interlocks/protection requirements - Operator interface requirements - Bypass indications - Post-event accessibility - System support requirements • Specific survivability requirements - Normal service environment - Loss of HVAC - Site hazards (seismic, tornado, missile, flood, freeze, lightning) - Transients - Fire/Safe shutdown - Vibration • Specific performance requirements - System flow requirements - Preferred failure modes - Reliability/availability goals - System/component impedance - Load duty cycle - Load electrical characteristics - Transient response - Testability - Separation/independence/diversity requirements

• Specific standards - American Society of Mechanical Engineers (ASME) - American National Standards Institute (ANSI) - American Society of Civil Engineers (ASCE) - Institute of Electrical and Electronics Engineers (IEEE) - American Concrete Institute (ACI) DOE–STD–1073–93 II-B-2 - American Institute of Steel Construction (AISC) - Hydraulics Institute (HI) - Instrument Society of America (ISA) - Standards from DOE Orders, commitments, etc. - Applicable NRC standards (10CFR, Standard Review Plan, Reg. Guides) • Specific regulatory requirements - DOE rules - DOE Orders - DOE safety guides • DOE correspondence and commitments - DOE safety evaluation reports - Facility safety analysis reports Design Constraints. • Engineering standard practice guidance, procedures, instructions - Design process methodology - Setpoint methodology - Design discipline methodologies - Architect Engineer/Vendor guides and standards • Computer codes used for design or design analysis (including user manuals) • General Regulatory Requirements - DOE 4700.1 - General Design Criteria - Safety Classification - Quality Classification • General Codes and Standards - American Society of Mechanical Engineers (ASME) - American National Standards Institute (ANSI) - American Society of Civil Engineers (ASCE) - Institute of Electrical and Electronics Engineers (IEEE) - American Concrete Institute (ACI) - American Institute of Steel Construction (AISC) - Hydraulics Institute (HI) - Instrument Society of America (ISA) - Applicable NRC standards (Standard Review Plan, Reg. Guides) • Quality Assurance Requirements - ANSI NQA-1 - ANSI N.45.2.11 Design Analysis and Calculations. • Engineering forms, evaluations, and documents used to implement designs and design changes DOE–STD–1073–93 II-B-3 • Calculations or analyses that verify that the design inputs and constraints are met - Component classification evaluations - Load sequencing and electrical supply sizing calculations - Setpoint calculations and methodologies - Equipment sizing calculations - Motor-operated valve calculations, analyses, or test results that establish switch setting/tolerances • Design baseline analysis and calculations to establish effects of postulated accidents: - Transient analysis - Site Hazards analysis - Seismic site specific criteria - Flooding site specific criteria - Ultimate heat sink analysis - Loss of spent fuel cooling analysis - Anticipated transient without scram • Instrument and Electrical - Diesel generator sizing - Power and instrument cable sizing - System voltage profiles - System short circuit analysis - Diesel generator performance - Bus transfer analysis - System protection and coordination analysis - Battery sizing - Instrument accuracy calculations - Instrument Setpoint calculations - Current loop response time calculations - Electrical separation analysis - Raceway fill and loading - Failure modes and effects analysis - Thermal form evaluation - Electromagnetic compatibility - Surge withstand capability - Control room design review - Set point tolerance - Calibration and scaling calculations - Lightning protection analyses - Emergency lighting calculations - Motor starting calculations - Station blackout analysis - Offsite/onsite independence - Operator response time calculations • Nuclear - Control room habitability analysis - Tornado loadings and external missile, - External flooding analysis - Pipe break effects - Equipment environmental qualification - Radiation source term identification

DOE–STD–1073–93 II-B-4 - Containment analytical model - Radioactivity transport analysis - Post accident conditions - Offsite dose analysis - Onsite personnel dose analysis - Heat load determination analysis - Heating, ventilation, and air conditioning (HVAC) failure modes and effects analysis (FMEA) - HVAC instrumentation setpoints - HVAC design analysis - Pipe flow hydrodynamic loads analysis - Piping network dynamic flow analysis - Valve operability analysis - ASME Code of record calculations - Computer code validations and certifications - Thermal analysis of components, supports, and structures - Component minimum wall thickness calculations • Civil - Concrete structures analysis - Steel structures analysis - Civil structure dynamic/earthquake analysis - Dynamic/stress analysis of substructures - Tornado analysis of structures - Weld evaluations - Block wall evaluations - Component seismic/structural qualification - Pipe rupture restraints - Bolt anchorage analysis - Probable maximum flood analysis - Platform steel, cranes, monorails, doors, ladders - Heavy loads analysis - Piping analysis - Generically qualified piping and supports - Rigorously analyzed piping and supports - Seismic analysis of electrical conduit - Instrument line analysis - Supports analysis (pipe, duct, conduit, instrumentation, etc.) - Foundation analysis - Seismic Category 2/Category 1 evaluation - Differential building settlement - Buried piping - Supplemental steel, building steel load tracking program - Equipment anchorage qualification - Anchor bolt load capacities • Mechanical - Piping minimum wall thickness - Pump minimum positive suction - Pump total system head - Valve pressure drops (C) - Tank nozzle/branch line reinforcement: DOE–STD–1073–93 II-B-5 - Heat transfer analysis - Pump/system performance analysis - Pressure/vacuum relief valve sizing - Sump capacity - Cooling water flow rates - Equipment performance calculations - Corrosion/erosion allowances - Tank sizing and wall thickness calculations - Pipe sizing/flow analysis - System design/operating pressures and temperatures - Pump brake horsepower requirements - Valve actuation and check valve closure times - Vibration data - Thermal expansion data - Design cycles for equipment and systems - System resistance • Identification and Consideration of Vendor Information - Vendor equipment allowable loads - Vendor equipment functional, seismic, and environmental qualification - Vendor equipment installation and maintenance requirements - Vendor standard component load capacities - Pressure ratings • Correspondence, meeting minutes, and other documents pertaining to design evaluations and considerations Design Output Documents. • System Descriptions, Modifications Descriptions • Specifications - Component - Material - Design - Installation Procurement - Piping classification list - Valve mark number list • Facility Component Lists - Valve Lists - Equipment Lists (Q-Lists) - Electrical Load Lists - Setpoint Lists - Fuse and Breakers Lists - Instrument and Controls - Environmental Qualification • Safety Analysis Report Changes DOE–STD–1073–93 II-B-6 • Safety Evaluations and Technical Review Checklists/Results - Technical Review Checklists - USQ safety evaluations and checklist • Process Software (or Firmware) Requirements Specifications • Instrument and Control Setpoints (Document)

• Mechanical Outputs - Basic flow diagrams - Heat balance diagrams - Piping and Instrument drawings (P&IDs) - Layout and arrangement - HVAC (area drawings) - Plumbing (area drawings) - Isometric drawings - Equipment location drawings - Typical support detail for field routed pipe - Design cycles for equipment and systems • Electrical Outputs -- One line diagrams - Elementary diagrams - Wiring diagrams - Equipment requirements and arrangements - Diesel generator load sequencing - Logic for electrical system - Fire and safety - Grounding - Conduit and tray - Communication and lighting - Underground conduit - Breaker coordination • Control Systems Outputs - Field locations and arrangement - Logic diagrams - Loop diagrams - Panel and console diagrams - User's guides • Nuclear Outputs - Core reload report • Pipe Support (Hanger and Support Design) • Operational Requirements - Operator action requirements - Normal operating parameters - Environmental requirements - Support system requirements DOE–STD–1073–93 II-B-7 • Maintenance Requirements - Preventive Maintenance - Vendor requirements • Testing Requirements - Post-modification testing - Surveillance testing - In-service inspection and testing • Construction and Installation Specifications - Inspection requirements Examples of Design Requirements and Design Basis Information. • System Level Design - Design Requirement: Emergency cooling system flow of 500 gpm must reach the reactor vessel within 25 seconds after initiation signal. Design Basis: The facility transient analysis assumes 500 gpm with a 25 second delay to mitigate a small break loss-of-coolant accident. The actual engineering analysis provide design margin for uncertainties by using 450 gpm with a 35 second delay. (ref. aa) - Design Requirement: Emergency electrical system must provide 1000 kW within 60 seconds of initiation. Design Basis: The nuclear safety electrical loads total 900 Kw. Cumulative additions to this electrical load lists are tracked (ref. ee). The facility transient analysis identifies that no more than 60 seconds elapse until emergency power is restored; the analysis assumes 85 seconds. (ref. xy) - Design Requirement: Primary system water chemistry must be maintained with dissolved oxygen between 500 and 1500 parts per billion. Design Basis: Dissolved oxygen above 500 parts per billion is enough to keep nitrate stable. Dissolved oxygen below 1500 parts per billion minimizes corrosion of stainless steel. (ref. fg) • Component Level Design - Design Requirement: Motor operated valve xyz must open in 10 seconds at 1 psid and 80 percent of rated voltage. Design Basis: 10 seconds is desired in order to meet the system response time requirement of emergency cooling system injection within 25 seconds at design basis conditions. (ref. calc. jk) DOE–STD–1073–93 II-B-8 - Design Requirement: Relief valve abc pressure setting of 165 psig and flow rate of I gpm. Design Basis: Parameters must meet ASME Section III, Section 7000 code requirements. Per code, pressure equals piping design pressure (ref. ef). Flow rate must be sufficient to prevent a pressure greater than 110 percent of the design pressure due to thermal expansion and leakage through the reactor vessel isolation valves. (ref. yz) - Design Requirement: Miniflow bypass valve pqr must open in 4 seconds.

Design Basis: 4 seconds is the desired opening time. The valve is designed to open as fast as practicable to minimize the time that the pump operates deadheaded. Valve and bypass piping are specified as 4 inch to pass pump miniflow requirement (ref. st). Past experience has demonstrated that vendors can supply fast opening valves with stem stroke rates of I inch per second. Hence, a 4 second stroke time for this 4 inch valve was selected. The engineering analysis indicates that up to 8 seconds is acceptable (i.e., 4 seconds of design margin is built into the design requirement). (Note: ref. pq). • Structure Level Design - Design Requirement: Lateral load resisting system elements must be designed to withstand 100 mph wind pressures. Design Basis: The lateral load resisting system provides stability to the structure under wind loading. A 100 mph wind velocity was selected according to ANSI A58.1 based on a review of the geographical location of the structure. (ref. bc) DOE–STD–1073–93 II-C-1 APPENDIX II–C CONDUCT OF WALKDOWNS This exhibit provides an overview and discussion of selected key issues related to CM walkdowns. These CM walkdowns are conducted as part of each phase of programmatic assessments: initial assessments, post-implementation assessments, and periodic programmatic assessments. This exhibit serves as additional guidance to prevent unnecessary rework and costs. It includes a generic CM component walkdown procedure for use in developing detailed walkdown procedures. The following discussion addresses selected key issues that should be considered when developing a walkdown program. Walkdown Objectives. The objectives of the CM walkdowns should be clearly stated, documented, and understood by facility personnel involved in the walkdowns. This will help ensure consistency among the CM walkdowns, prevent confusion (especially with the objectives of other facility walkdown efforts), and minimize rework. The objectives of the CM walkdowns are to (1) establish the as-found physical configuration of the facility and (2) identify any discrepancies between the as-found configuration and associated facility documentation. Consolidation of Walkdowns. Experience has shown that numerous walkdowns may be performed at a typical facility for different (but similar) reasons. For example, walkdowns may be performed as part of a hazards evaluation, design package preparation, functional evaluation, or in response to a regulatory commitments related to seismic, equipment qualification, or fire protection concerns. Prior to beginning the CM walkdowns, consideration should be given to identifying other walkdown efforts that may be needed within the same time frame and consolidating and/or integrating them, as appropriate. Some of the information gathered by different walkdowns may be identical and can be obtained once if the interfaces are established and consolidation is properly achieved. Other types of information can be added to the CM walkdown procedures and used to satisfy other needs thereby reducing the total number of walkdowns performed at each facility.

Critical Component Characteristics. Central to the success of the walkdown effort is the identification of critical component characteristics. These characteristics provide the structure for the component data sheets, which are used to collect, document, and transmit the data for inclusion into the equipment database. Prior to the commencement of the CM walkdowns, critical characteristics for each SSC should be identified in the walkdown procedures. Acceptable sources for these characteristics are the available design requirements, industry codes and standards, comparison of the critical characteristics with similar SSCs, and engineering judgement. The following are examples of some critical characteristics for mechanical, electrical, and I&C components: Mechanical Components • component number • flow diagram number • manufacturer • model number • serial number • style/type • system • size (e.g., pipe size, flow, critical velocity, etc.) • pressure rating DOE–STD–1073–93 II-C-2 • temperature rating • material • operator type (if applicable) • orientation • other (e.g., locking devices, extensions, etc.) Electrical Components • component number • drawing number (e.g., schematic, one-line diagram, etc.) • manufacturer • model number • serial number • component type • power (watts) • voltage (e.g., 125 DC, 4KV AC, etc.) • amperage • contact rating • other (e.g., environmental qualification, fuse type, location, etc.) Instrumentation and Control Components • component number • drawing number • manufacturer • model number • serial number • style/type • range • input (e.g., psi, milliamperes, inches, H 0, etc.)2 • output • pressure rating • power • voltage (if applicable) • amperage (if applicable) • other Methodology. The following generic CM walkdown procedure incorporates good practices and successful features of numerous configuration management walkdown efforts performed throughout the industry. By design, it is conceptual and not facility-specific but will provide general guidance and a basic foundation from which to develop a detailed configuration management component walkdown program. For significant walkdown efforts, pilot walkdown programs may be useful in refining the walkdown methodology. DOE–STD–1073–93 II-C-3 CONFIGURATION MANAGEMENT GENERIC WALKDOWN PROCEDURE CONTENTS Sect. Title Page(s) 1.0 PURPOSE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–4 2.0 OBJECTIVES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–4 3.0 SCOPE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–4 4.0 REFERENCES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–4 5.0 KEY DEFINITIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–4 6.0 PRECAUTION & LIMITATIONS . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–5 7.0 RESPONSIBILITIES . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–5 • Walkdown Team • CM Coordinator • Equipment Database Coordinator • QA/QC 8.0 INSTRUCTIONAL GUIDANCE . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–6

ATTACHMENT A . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . II–C–9 DOE–STD–1073–93 II-C-4 1.0 PURPOSE. This procedure describes the responsibilities and steps necessary to perform walkdowns for the purpose of establishing the as-found physical configuration of the facility, and identifying any discrepancies with the associated facility documentation. 2.0 OBJECTIVES. The objectives of the CM walkdowns are to: • Establish the as-found physical configuration of the facility • Identify any discrepancies between the as-found configuration and associated facility documentation 3.0 SCOPE. This document applies to all formal efforts by facility and contractor personnel to reconstruct missing data or field verify existing Equipment Database information through walkdowns on mechanical, electrical, and instrumentation and control (I&C) systems. This will be accomplished by performing the walkdowns on a system-by-system basis to identify the as-found physical configuration and to obtain missing nameplate data for inclusion into the CM Equipment Database. 4.0 REFERENCES. The following are examples of relevant types of documents that should be identified and referenced In support of this walkdown effort: • Drawings (e.g., P&IDS, schematics, location drawings, vendor drawings, etc.) • Operations Procedures (e.g., system startup, system operations, etc.) • QA Procedures (e.g., non-conformance items, field deviation notices, drawing change notices, independent verification, etc.) • Equipment Database Procedures • Engineering Procedures • Maintenance Procedures (e.g., work request, scaffold erection, etc.) • Security and Safeguard Procedures • Radiation Protection Procedures (if applicable) • Special Requirements covering EQ, fire protection, etc. • Safety Analysis Report 5.0 KEY DEFINITIONS. • Walkdown: A visual inspection of facility SSCs to identify the as-found physical configuration and any discrepancies with currently approved facility documentation. • Nameplate: The plate or label attached to a component by the manufacturer to provide applicable component identification and design data, such as temperature, pressure, flow etc. • Walkdown team: Personnel responsible for gathering information during the walkdown, and for verifying and documenting the accuracy and completeness of this information. For this effort, each walkdown team should consist of at least two qualified personnel. DOE–STD–1073–93 II-C-5 • Second Party Verification: Verification of the data gathered during the walkdown by a second member of the walkdown team. Periodic sampling by QA/QC may also be performed, as appropriate. • Component Configuration Data (CCD) sheets: The method used for documenting both the component nameplate data and the independent verification. The CCD sheets will also be the mechanism for identifying missing nameplates or for transferring acquired data into the equipment database. Attachment A provides an example CCD. • Configuration Management Equipment Database: The computerized database that contains facility component information such as the design requirements, manufacturer's identification numbers, etc. • Piping and Instrument Diagram (P&ID): A drawing which graphically displays the process for each facility system and depicts the relevant components within each system. The P&ID also shows the functional relationship between components (e.g., first a pump, followed by an isolation valve, then a tank, etc).

6.0 PRECAUTIONS AND LIMITATIONS. • At nuclear facilities, a radiation work permit (RWP) is required for each walkdown performed inside the radiation controlled area and shall be obtained in accordance with the applicable facility procedures. • All relevant facility safety practices shall be in effect and shall be followed, as appropriate (e.g., use of hard hats, ear protection, eye protection, scaffolding erection, chemical hazard protection, etc). Minimal risk to personal safety will be exercised in obtaining walkdown information; if in doubt, ask for assistance. • Components shall not be operated, disassembled, or affected in any way, except by authorized personnel (e.g., walkdown personnel can not change a valve position, open an energized cabinet, turn a switch, etc). • The Operations Department shall be notified and authorization obtained (e.g., from the shift supervisor, wing supervisor, or other operation's manager on shift) prior to conducting a walkdown of each system. 7.0 RESPONSIBILITIES. • The walkdown teams are responsible for: - conducting the walkdowns in accordance with this document and other relevant facility procedures; collecting nameplate data; - assuring the accuracy and completeness of the data; - performing second party verification of this data; documenting this verification; and - providing the completed CCD sheets to the Walkdown Coordinator for review and further processing. DOE–STD–1073–93 II-C-6 • The Configuration Management Coordinator is responsible for: - selecting the walkdown teams and ensuring that team members have appropriate background experience and training to be qualified to perform their role in walkdowns; - supervising the activities of the walkdown teams; - reviewing and approving the CCD sheets for completeness; - transmitting completed and approved CCD sheets to the Equipment Database coordinator for inclusion into the Equipment Database; and - initiating any follow up actions (e.g., work requests, re-walkdowns, drawing change notices, NCRS, etc.). to resolve discrepancies, including soliciting approval from the design authority • The Equipment Database coordinator is responsible for: - obtaining the CCDs from the Configuration Management Coordinator, and incorporating this data into the Equipment Database; and - providing the Configuration Management Coordinator with a printout for any components within a system that have not been field verified after the system walkdown has been completed. The objectives are to ensure that a component has not been missed during the walkdown and that the CCD sheets have been properly submitted and the information included in the Equipment Database. • The QA/QC group is responsible for: - reviewing the methodology and procedures used to field verify component data; - periodically inspecting the walkdown work in progress to ensure that it conforms to the approved procedures and that an acceptable level of accuracy is achieved; - identifying and tracking to completion QA/QC discrepancies; and - working with the Configuration Management Coordinator and walkdown teams to resolve any identified deficiencies. 8.0 INSTRUCTIONAL GUIDANCE. • All individuals associated with the component as-bulk configuration walkdown effort will be trained on this procedure prior to conducting the verification walkdowns.

• Each walkdown team will consist of at least two individuals experienced in the use of applicable drawings (e.g., P&IDS, electrical single-line drawings and schematics, etc.). Prior to each walkdown, the walkdown team will obtain and use the latest approved revisions of the applicable drawings from the master file maintained by the Document Control Group. DOE–STD–1073–93 II-C-7 • The major steps to be followed by each CM walkdown team member are as follows: a. Prior to each walkdown, meet with the Configuration Management Coordinator to discuss which system(s) or portions of systems are scheduled for a walkdown. b. Obtain the appropriate drawings, a copy of this procedure, and an adequate number of blank CCD sheets. c. Contact the Operations Department and obtain authorization from the operations supervisor on shift to conduct a walkdown of the scheduled system(s). d. Consistent with the appropriate Radiation Protection procedures, determine and comply with the Radiation Work Permit (RWP) requirements for the area(s) scheduled for a walkdown. e. Upon entering the area, comply with the necessary safety requirements (e.g., ear protection, hard hats, etc.) and determine the need for special access equipment (such as ladders, scaffolding, etc.) as soon as practical; follow proper facility procedures for acquiring and using this equipment. CAUTION: Do not step on cable trays, insulated pipe, hand wheels, cantilevered valves, operating equipment, or anything that may be damaged or could cause harm. f. Conduct walkdowns of the identified system(s) or portions of systems to verify as-built configuration by gathering component nameplate data and documenting this data on the CCD sheets. Copies of the CCD sheets are included as Attachment A to this procedure. NOTE: One or more of the team members may gather this data; however, care should be taken to insure some degree of independence (i.e., at least one member should be designated as the "first" party and a second member designated as the "second" party (independent) verifier for each component). g. During the walkdowns, check the accuracy of the P&IDs to ensure that the functional relationships are correctly represented and that all components are accurately depicted. Annotate the drawings, as appropriate, to show the as-found configuration and retain the original for review and processing. h. Perform the second party verfification of the component nameplate data and P&ID. Both the first party and the second party verifier will sign the completed CCD street and P&ID, as appropriate. NOTE: The objective of the second party verification is to ensure, by direct observation, that the correct data is obtained. For example, if a valve is located overhead and access to the component nameplate is by ladder, both team members will climb the ladder to verify the information. Only one person going up and calling down to the other is not considered a second party, independent verification and is therefore unacceptable for the purposes of this step. i. During the walkdowns, general facility material and housekeeping conditions should also be observed and any irregularities or unusual conditions should be reported in the comments/remarks section of the CCD. Examples of what to look for are as follows: DOE–STD–1073–93 II-C-8

• Obvious physical damage to equipment • Missing or illegible tags • Loose, bent, or missing supports and/or anchors • Valve packing glands "bottomed out" or unsymmetrical • Leaks e.g., water, oil, steam, etc. • Missing, bent, or broken valve handwheels • Missing or loose cover plates • Gagged relief valves • Unterminated cables showing bare wire • Missing fuses • Unauthorized temporary modifications • Debris j. If the documentation becomes contaminated, the information can be transferred to non- contaminated documents and verified accurate, by signature and date, by both first party and second party personnel. The contaminated documents may then be destroyed. k. Record the progress of the walkdown by highlighting the applicable drawings. These highlighted drawings, along with the completed CCDs should be given to the CM Coordinator at the end of each day to keep him updated on the progress of' the walkdown effort. l. The Configuration Management Coordinator shall: • Review the completed CCD sheets and, if approved, make copies and transmit the copies to the Equipment Database coordinator for inclusion into the database. If not approved, the Configuration Management Coordinator will take whatever action is necessary to resolve the problem(s); • Review the annotated P&IDs and submit document change notices, as required; and • Handle the completed CCDs and associated documentation as QA records and ensure that they are maintained in controlled files for a retention period consistent with standard facility document control/records management procedures. DOE–STD–1073–93 II-C-9 ATTACHMENT A COMPONENT CONFIGURATION DATA SHEET "SAMPLE" VALVES Drawing Number Plant Unit Number Component Number System Manufacturer Style/Type Model Number Serial Number Pipe Size Cv Pressure Temperature Material Operator Type Remarks/Comments: Collected by (first party) Date Verified by (second party) Date Approved by (CM Coordinator) Date DOE–STD–1073–93 II-D-1 APPENDIX II–D CONTENT OF DESIGN INFORMATION SUMMARIES There are many different design information summary (DIS) formats that adequately present the needed information. This appendix presents an acceptable format and discussion that may be useful in establishing facility-specific DIS formats. This appendix also discusses DIS benefits. The following discussion focuses on a system DIS. Format and content for a topical DIS can be developed using this general guidance. The following general format could be adopted for a system DIS: • System Description • Operability Requirements • System Design Requirements • System Design Basis • Component Requirements and Basis • Design Topics • Additional Information This format captures the recommended DIS contents and organizes them into a user-friendly format. This format has the fundamental attribute of starting with basic and going into increasing levels of detail. Component-level design considerations are separated from system-level design considerations. Certain design topics (such as operations, maintenance, and testing requirements) are separated from other design considerations to provide focused attention for the end-users.

DISs should use the matrix approach, which makes significant use of text material but references key supporting design process documents. The text includes system descriptions and drawings, operability requirements, system functions, component information, system and component design basis, regulatory requirements, and DOE commitments. Referenced documents should include calculations and analyses, codes and standards, design practices, procurement specifications, and TSR. It is unnecessary to duplicate the content of other self-contained documents such as ASME code stress reports, environmental qualification data packages, vendor manuals, operations and maintenance procedures, industry codes and standards, specifications, generic regulatory requirements, and calculations. The following discussion provides the information that should be included in each DIS section. The type of information included in the DIS should be directly related to specific user needs in support of the overall program objective. DISs are written for a variety of users and experience levels. DIS users will range from operations, maintenance, testing, procurement, training, and QA personnel to design engineers. DISs should be tailored to meet individual facility needs and constraints, making use of existing programs and results. SYSTEM DESCRIPTION This information provides general background and introduction regarding the DIS's subject. To avoid reliance on current experience levels, DISs should be written for a hypothetical 3-year engineer. Such an engineer (or scientist) would have a general facility background, would know the facility layout, and would know the general actions the system needs to perform. The descriptive information for a system DIS could be presented in the following DIS sections: DOE–STD–1073–93 II-D-2 • System Description. A narrative discussion of the system configuration. A general discussion of system location and boundaries (with drawings). General narrative of functional and operational requirements for the various plant modes and operating conditions. • System Boundaries. A detailed discussion of system boundaries and how they, were established. Reference location or listing of complete scope of system SSCs. • System Interfaces. A listing or narrative description of interfacing systems that are necessary for the subject system to perform its function. A description of functional requirements necessary from support systems. Typical support systems include electrical distribution systems, instrument air systems, HVAC systems, component cooling water systems, lube oil systems, etc. • System Classification. A discussion of applicable CM system grade (i.e., safety, environmental, mission, or other). Identification of principal functions or requirements that established the system grade. In addition, identification of basis for any other applicable system classifications used at the facility, such as quality classification, seismic classification, etc. • System Issues. Discussion of any critical system issues that provide important perspective on the system design requirements or design basis. These may be major issues under study or investigation, code cases under review, positions under DOE review, or generic. issues under resolution. OPERABILITY REQUIREMENTS Provide a concise and complete statement of the operability requirements as specified by the TSR. Identity the SSCs necessary to satisfy these requirements. Specify the auxiliary and support systems required for operability.

This section is separated from other design requirements both to emphasize its importance and for easy reference. This section will likely be used to assist operability determinations and to ensure that new designs maintain these top-level requirements. The Operating Organization is an important end- user of this section. SYSTEM DESIGN REQUIREMENTS Always identify design requirements by type: safety requirements, environmental requirements, mission requirements, and others. The design requirement information for a system DIS could be presented in the following DIS sections: • Functional and Performance Requirements. A listing or narrative description of the system process requirements. This may include the following: - System flows, pressures, heat loads, thermal power ratings, operating temperatures etc.; - Special system design considerations such as net positive suction head requirements; - Facility transients and accidents the system supports and how the availability of the system is ensured; DOE–STD–1073–93 II-D-3 - A brief description of environmental limitations on system operation, such as normal radiation fields and possible post-accident conditions; - Key instrumentation and control requirements to provide remote shutdown capability and enable local monitoring of process activities and - System performance characteristics under various normal and infrequent operating modes and off-normal operating conditions (examples include system head-flow characteristic curves, natural circulation performance curves, and system hydraulic profile). • System Setpoints. Listing of important system setpoints with reference to design basis. • System Instrumentation and Alarms. Description of the requirements for instrumentation and controls to ensure proper function and performance of the system. Description of alarm capabilities. • System Interlocks. Descriptive information on interlocks with interfacing systems, the logic at the interlock, and reference to logic diagram and bases of interlock. SYSTEM DESIGN BASIS The design basis information for a system DIS could be presented in the following DIS sections: • Authorization Basis. This DIS section describes those aspects of the design basis relied on by DOE to authorize operation. The authorization basis is described in documents such as the facility Safety Analysis Report and other safety analyses, hazard classification documents, Technical Safety Requirements, DOE-issued Safety Evaluation Reports, and facility-specific commitments made in order to satisfy DOE Orders or policies. This section may include discussions of the applicable accident scenarios that require the system to operate and the design inputs that need to be met. List any commitments to DOE. • Design Inputs. List important design inputs with emphasis on codes and standards. Identify the original bases codes and standards (including year and addenda) adopted that specifically apply to the DIS as a whole. Identify NRC and commercial nuclear codes and standards adopted. List applicable DOE Orders, rules, and standards. Identify any exceptions to requirements that are reflected in the design. The applicable codes and standards should be listed along with a reference to the commitment to DOE. Identify whether the codes are optional or required (committed). Any exceptions to, or interpretations of, these requirements that are applicable to the current facility design are provided.

• Design Constraints. List and/or reference applicable system design constraints, including design procedures, methods, and guidelines. • Design Analysis and Calculations. List and/or reference applicable system design analysis and calculations. COMPONENT REQUIREMENTS AND BASIS Major components often merit being addressed separately and uniquely. A separate DIS section on component information addresses important component design information without breaking the flow of system-level design information. Identify major system components. Identify important classes of components within the system, such as motor-operated valves. Provide component-level design DOE–STD–1073–93 II-D-4 requirements such as capacity, reliability, limits, and settings. Component information such as seismic qualification and equipment environmental qualification would be included here if not in a separate topical DIS. Include or reference component design basis. Discussion may include the following: • A description of each major component • Required functions • Design basis • A discussion of operating modes and the role of the component in the system • A discussion of how the installed component configuration satisfies the system design basis DESIGN TOPICS These topics are separated from previous discussion for the benefit of the end-user. Selection of these or other topics may be based on an analysis of user needs. Topics that are not separated would be included in the previous sections. Both design requirements and design basis would be provided, with emphasis on the design requirements. It may be appropriate to reference some basis material. The following design topics for a system DIS could be presented: • Applicable Topical Areas. This section would reference applicable topical DISs and discuss the scope covered by the topical DIS. Design requirements and design basis covered in topical DISs do not have to be covered in the system DIS. The system DIS would provide a pointer to the applicable topical DISs. • External Hazards. Discussion of the applicability of certain external hazards to the system may be presented. Alternatively, reference discussion provided in topical DISs, such as environmental qualification requirements, seismic requirements, fire protection requirements, and hazards protection requirements (including flood protection, missile protection, tornado protection, lightning protection etc.). • Structural Requirements. Discussion of the requirements for seismic, wind, thermal, water, and any other static and dynamic load condition (including accidents), stress, shock, and reaction forces. Equipment foundations and major components (e.g., tanks, pumps, heat exchangers, ducts, and duct supports) may be discussed. • Operational Requirements. Description of specific operational requirements established in the design process, such as acceptable operating modes, required operating ranges and limits, special operational actions to be taken in the event of component failures or unusual operating conditions (such as severe weather), special system interlocks requirements, and key operational considerations for equipment and personnel protection. • Maintenance Requirements. Description of specific maintenance requirements established in the design process, such as periodic maintenance requirements, acceptable maintenance practices, preapproved part replacements, and maintenance ranges (e.g., switch setting ranges, torque ranges etc.).

• Special Material or System Chemistry Considerations. Discussion of any special materials used in the system or components and the basis for material selection. Any materials that are prohibited from use in the components/systems should be stipulated. In addition, any special system chemistry considerations should be defined and discussed in this section. DOE–STD–1073–93 II-D-5 • In-service Inspection Requirements. Discussion of in-service inspection (ISI) and in-service testing (IST) as specified by Section XI of the ASME Code. These requirements should be summarized and the procedures that implement the specific ISI and IST requirements should be listed or referenced. • Testing and Testability Requirements. Describe testing requirements established by design engineering. Describe unique system testing requirements that resulted in special system design features. • Material Condition and Aging Management. Describe additional testing or operational measures specified by the MCA program. May include both those measures specified for life extension and other measures for general aging management. ADDITIONAL INFORMATION In addition to sections described above, the following provides information that may be useful in understanding existing configuration and evaluating proposed changes. The users and uses of the facility DISs may influence the selection and content of these sections. These sections are optional. • Change History. Description of the design change history. The change history section is either a narrative or a listing of changes to the system since facility startup with an explanation of the need for each change. This information serves several purposes: (1) provides a ready source of rationale for past changes to systems, structure, and components; (2) aids the review process to ensure design basis and requirements are updated and design continuity is maintained; and (3) assists the process of root cause determination of operational problems. • Design Margin. Design margin is the conservatism between the specified design requirement and the minimum requirement that could be developed from the design basis. This section could be presented as a table that shows the specified design requirement compared to the possible design requirement if margin was removed. It could be invaluable when evaluating operability concerns. In addition, this section could be a key input to the preparation of USQ safety reviews, since this information addresses the impact of changes on the margin of safety. However, this can be a difficult section to develop in that system sensitivity analyses, which would enable identifying component margins, may not have been performed. It is important not to identify margin that was added for calculational uncertainty as usable design margin. Identifying and documenting margins when specific design basis information is being developed, or as subsequent analyses are performed, could be a valuable reference. • Summary of Critical Calculations. Summaries of the most important system calculations could be provided along with basic assumptions, calculational methods, relationship to other calculations, and general conclusions of calculations. • Postulated Failures. Description of failure modes considered in the system design. It could include passive failures, such as pipe breaks, and active failures, such as failure of a valve to close or pump to start on demand. A discussion of the impacts of a postulated support system failure, (such as a valve repositioning on a loss of instrument air) could also be included. Facility events may lead to special tests or analyses that can be used as inputs to this section.

• Response to Transients. The specific response of the system could be described for facility transients and accidents. DOE–STD–1073–93 II-D-6 GENERAL INFORMATION DISs would typically include these general sections: • Introduction. Provide overall document format and content. Describe intended purpose, uses, and users of document. Briefly describe DR process. Describe maintenance and control of document. Reference DIS User's Guide. • Open Items. DISs might be issued without full resolution of open items and discrepancies identified during the information retrieval, evaluation, and validation. Provide a list of open items from the DR process, such as document conflicts, missing or inadequate documentation, unresolved issues of a specific or generic nature, and discrepancies found during field validation. State the process and schedule to complete resolution of any open items. Include a categorization or prioritization of items, if established. Periodically update open item lists until resolution is complete. This list is typically provided in an appendix or toward the back of the document. • References. A list of the documents containing design basis information. These include calculations, analyses, engineering evaluations, correspondence, topical reports, vendor reports and evaluations, engineering safety evaluations, and other data. • Tables/Figures/Appendices. Tables and figures may be utilized to list data. Tables and figures should be referenced to the appropriate section. Appendices or attachments may include detailed information that is not in the main body of the DIS. • Miscellaneous. DISs typically include Cover Sheet, List of Effective Pages, Table of Contents, List of Figures, List of Tables, and other administrative pages or sections. DIS BENEFITS The primary benefits are derived from the actual reconstitution of the design requirements and design basis, rather than from formatting this information into DISs. Once the design information is reconstituted, it is made available through the CM equipment database. However, for facilities with limited databases, DISs serve as the primary source of equipment information. The greatest benefit of an effective design reconstitution program may be the avoidance of facility downtime (i.e., major shutdown for design basis reconstitution). The ability to identify and use existing design margins when problems arise is also important. DISs provide valuable design input information readily accessible for evaluation of future changes and facility modifications. The importance of design basis lies in the evaluation of changes -- either previous changes or proposed changes -- including the evaluation of system/equipment degradation. If a change is not being evaluated or if the design requirements are valid and known, the need to understand the design basis would be minimal. In these instances the design basis could be developed in conjunction with proposed changes or the evaluation of changes that impact the design requirements. However, if a prospective design change would also involve the redevelopment of extensive design information for the facility system involved, the cost of making that particular change might become prohibitive and, accordingly, the consequence could be the inability to make needed facility improvements. DOE–STD–1073–93 II-D-7 The following lists (by primary organization) additional benefits and potential applications of DISs.

Engineering • Conceptual design development and alternative considerations • Design specification for in-house or contractor designers • Calculations and analysis • Bases for technical reviews, safety reviews, and USQ evaluations • Independent design verifications • Procurement specifications • Identification of information and documents affected by changes • Installation specifications • Installation and functional testing requirements and acceptance criteria • Field change request evaluations • Evaluations of operational events and nonconforming conditions • Justifications for continued operation (JCOs) • Selection and review of equipment performance surveillance data • Bases for operations, maintenance, and surveillance procedures review • Evaluation of material substitution, spare parts equivalency, and materials upgrades • Temporary modification reviews Operations • Abnormal event assessment • Reportability determinations • Operability determinations • Bases for unusual system alignment (e.g., for maintenance or testing) assessments • Selection and review of component and system performance data • Addressing non-proceduralized events • Operator aids and training material development • Operations procedures development and review Maintenance • Post-maintenance test requirements and acceptance criteria • Procedure and work instruction preparation and review • Assessment of material condition requirements Training • Bases for lesson plans and training materials • Simulator fidelity Other • SAR validation, analyses, and changes • TSR review and changes • Performing technical audits • Life extension • Probabilistic Risk Assessments • Margin Management DOE–STD–1073–93 CONCLUDING MATERIAL Review Activities: Preparing ActIvity: DOE Field Offices DOE–EH–63 DP AL EH CH Project Number EM ID NE NV CMAN–0001 NS OR RW RL ER SR CE SF AD Fernald PR FE Area Offices OE Amarillo SA Brookhaven Kansas City National Laboratories Kirtland Golden ANL Princeton BNL Rocky Flats LBL LLNL METC LANL PNL Sandia CONTENTS CHAPTER 2 IMPLEMENTATION GUIDANCE FOR OPERATIONAL CONFIGURATION MANAGEMENT 2.1 PROGRAM MANAGEMENT ELEMENT 2.1.1 PROGRAM PLANNING 2.1.2 INTERFACES 2.1.3 DATABASES 2.1.4 CONFIGURATION MANAGEMENT PROCEDURES 2.1.5 SPECIFIC APPLICATION OF GRADED APPROACH: PROGRAM MANAGEMENT ELEMENT 2.2 DESIGN REQUIREMENTS ELEMENT 2.2.1 ESTABLISHMENT OF DESIGN REQUIREMENTS AND DESIGN BASIS 2.2.2 ASSIGNMENT OF SSC GRADES 2.2.3 FULLY DEVELOPED ELEMENT 2.2.4 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN REQUIREMENTS ELEMENT 2.3 DOCUMENT CONTROL ELEMENT 2.3.1 INITIAL DEVELOPMENT ACTIVITIES 2.3.2 FULLY DEVELOPED ELEMENT 2.3.3 SPECIFIC APPLICATION OF GRADED APPROACH: DOCUMENT CONTROL ELEMENT 2.4 CHANGE CONTROL ELEMENT 2.4.1 INITIAL DEVELOPMENT ACTIVITIES 2.4.2 FULLY DEVELOPED ELEMENT 2.4.3 SPECIFIC APPLICATION OF GRADED APPROACH: CHANGE CONTROL ELEMENT 2.5 ASSESSMENTS ELEMENT 2.5.1 INITIAL ASSESSMENTS 2.5.2 POST-IMPLEMENTATION ASSESSMENTS 2.5.3 ONGOING ASSESSMENTS 2.5.4 SPECIFIC APPLICATION OF GRADED APPROACH: ASSESSMENTS ELEMENT CHAPTER 3 IMPLEMENTATION GUIDANCE FOR DESIGN RECONSTITUTION 3.1 PROGRAM PLANS AND PROCEDURES 3.1.1 DESIGN RECONSTITUTION PROGRAM PLAN 3.1.2 DESIGN RECONSTITUTION ACTION PLAN 3.1.3 DESIGN RECONSTITUTION PROGRAM GOVERNING AND IMPLEMENTING PROCEDURES 3.2 IDENTIFICATION AND RETRIEVAL OF DESIGN INFORMATION 3.2.1 IDENTIFICATION AND RETRIEVAL OF SOURCE DOCUMENTS 3.2.2 EXTRACTION OF DESIGN INFORMATION

3.3 EVALUATION, VERIFICATION, AND VALIDATION OF DESIGN INFORMATION 3.3.1 VERIFICATION OF DESIGN INFORMATION 3.3.2 TECHNICAL VALIDATION OF DESIGN INFORMATION 3.3.3 RELEASE OF VERIFIED AND VALIDATED DESIGN INFORMATION 3.3.4 CORRELATION OF DESIGN BASIS TO DESIGN REQUIREMENTS 3.3.5 TECHNICAL MANAGEMENT REVIEW OF DESIGN INFORMATION 3.4 RESOLUTION OF DISCREPANCIES 3.5 REGENERATION OF MISSING CRITICAL DESIGN INFORMATION 3.5.1 REGENERATION OF DESIGN REQUIREMENTS 3.5.2 REGENERATION OF DESIGN BASIS 3.6 PREPARATION AND ISSUANCE OF DESIGN INFORMATION SUMMARIES 3.6.1 PILOT DESIGN INFORMATION SUMMARY PROGRAM 3.6.2 DESIGN INFORMATION SUMMARY FORMAT AND CONTENT GUIDE 3.6.3 DESIGN INFORMATION SUMMARY LAYOUT GUIDE 3.6.4 DESIGN INFORMATION SUMMARY USERS' GUIDE 3.6.5 FINAL VERIFICATION OF DESIGN INFORMATION SUMMARIES 3.6.6 ISSUANCE OF DESIGN INFORMATION SUMMARIES 3.6.7 FIELD VALIDATION OF DESIGN INFORMATION SUMMARIES 3.6.8 MAINTENANCE AND CONTROL OF DESIGN INFORMATION SUMMARIES 3.7 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN RECONSTITUTION CHAPTER 4 IMPLEMENTATION GUIDANCE FOR MATERIAL CONDITION AND AGING MANAGEMENT 4.1 PRELIMINARY MCA PHASE 4.1.1 COMPONENT SCREENING 4.1.2 AGING DEGRADATION MECHANISM EVALUATIONS 4.1.3 ESTIMATION OF FACILITY REMAINING LIFETIME 4.1.4 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS 4.1.5 MCA PROGRAM PLAN 4.2 DETAILED MCA PHASE 4.2.1 MCA ACTION PLAN AND PROCEDURES 4.2.2 FINAL IDENTIFICATION OF LIFE-LIMITING COMPONENTS 4.2.3 DETAILED AGING DEGRADATION EVALUATIONS 4.2.4 DETERMINATION OF FACILITY REMAINING LIFETIME 4.2.5 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS 4.3 LIFE EXTENSION TECHNIQUES 4.4 ONGOING MCA PHASE 4.4.1 DEGRADATION TRENDING 4.4.2 APPLICATION OF LIFE EXTENSION TECHNIQUES 4.5 SPECIFIC APPLICATION OF GRADED APPROACH: MCA ADJUNCT PROGRAM APPENDIX lI–A DESIGN CONTROL APPENDIX II–B EXAMPLES OF DESIGN INFORMATION APPENDIX II–C CONDUCT OF WALKDOWNS APPENDIX II–D CONTENT OF DESIGN INFORMATION SUMMARIES CONCLUDING MATERIAL doe-std-1073-93-ch2.pdf CONTENTS CHAPTER 2 IMPLEMENTATION GUIDANCE FOR OPERATIONAL CONFIGURATION MANAGEMENT 2.1 PROGRAM MANAGEMENT ELEMENT 2.1.1 PROGRAM PLANNING 2.1.2 INTERFACES 2.1.3 DATABASES 2.1.4 CONFIGURATION MANAGEMENT PROCEDURES 2.1.5 SPECIFIC APPLICATION OF GRADED APPROACH: PROGRAM MANAGEMENT ELEMENT 2.2 DESIGN REQUIREMENTS ELEMENT 2.2.1 ESTABLISHMENT OF DESIGN REQUIREMENTS AND DESIGN BASIS 2.2.2 ASSIGNMENT OF SSC GRADES 2.2.3 FULLY DEVELOPED ELEMENT 2.2.4 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN REQUIREMENTS ELEMENT 2.3 DOCUMENT CONTROL ELEMENT 2.3.1 INITIAL DEVELOPMENT ACTIVITIES 2.3.2 FULLY DEVELOPED ELEMENT 2.3.3 SPECIFIC APPLICATION OF GRADED APPROACH: DOCUMENT CONTROL ELEMENT 2.4 CHANGE CONTROL ELEMENT 2.4.1 INITIAL DEVELOPMENT ACTIVITIES 2.4.2 FULLY DEVELOPED ELEMENT 2.4.3 SPECIFIC APPLICATION OF GRADED APPROACH: CHANGE CONTROL ELEMENT 2.5 ASSESSMENTS ELEMENT 2.5.1 INITIAL ASSESSMENTS 2.5.2 POST-IMPLEMENTATION ASSESSMENTS 2.5.3 ONGOING ASSESSMENTS 2.5.4 SPECIFIC APPLICATION OF GRADED APPROACH: ASSESSMENTS ELEMENT Chapter 3 3.1 Program Plans and Procedures 3.2 Identification and Retrieval of design Information 3.3 Evaluation, Verification, and Validation of Design Information 3.4 Resolution of Discrepancies 3.5 Regeneration of Missing Critical Design Information 3.6 Preparation and Issuance of Design Information Summaries 3.7 Specific Application of Graded Approach: Design Reconstitution

Chapter 4 4.1 Preliminary MCA Phase 4.2 Detailed MCA Phase 4.3 Life Extension Techniques 4.4 Ongoing MCA Phase 4.5 Specific Application of Graded Approach: MCA Adjunct Program Appendix II-A, Design Control Appendix II-B, Examples of Design Information Appendix II-C, Conduct of Walkdowns Appendix II-D, Content of Design Information Summaries Concluding Material doe-std-1073-93-ch3.pdf CONTENTS Chapter 2 2.1 Program Management Element 2.2 Design Requirements Element 2.3 Document Control Element 2.4 Change Control Element 2.5 Assessments Element CHAPTER 3 IMPLEMENTATION GUIDANCE FOR DESIGN RECONSTITUTION 3.1 PROGRAM PLANS AND PROCEDURES 3.1.1 DESIGN RECONSTITUTION PROGRAM PLAN 3.1.2 DESIGN RECONSTITUTION ACTION PLAN 3.1.3 DESIGN RECONSTITUTION PROGRAM GOVERNING AND IMPLEMENTING PROCEDURES 3.2 IDENTIFICATION AND RETRIEVAL OF DESIGN INFORMATION 3.2.1 IDENTIFICATION AND RETRIEVAL OF SOURCE DOCUMENTS 3.2.2 EXTRACTION OF DESIGN INFORMATION 3.3 EVALUATION, VERIFICATION, AND VALIDATION OF DESIGN INFORMATION 3.3.1 VERIFICATION OF DESIGN INFORMATION 3.3.2 TECHNICAL VALIDATION OF DESIGN INFORMATION 3.3.3 RELEASE OF VERIFIED AND VALIDATED DESIGN INFORMATION 3.3.4 CORRELATION OF DESIGN BASIS TO DESIGN REQUIREMENTS 3.3.5 TECHNICAL MANAGEMENT REVIEW OF DESIGN INFORMATION 3.4 RESOLUTION OF DISCREPANCIES 3.5 REGENERATION OF MISSING CRITICAL DESIGN INFORMATION 3.5.1 REGENERATION OF DESIGN REQUIREMENTS 3.5.2 REGENERATION OF DESIGN BASIS 3.6 PREPARATION AND ISSUANCE OF DESIGN INFORMATION SUMMARIES 3.6.1 PILOT DESIGN INFORMATION SUMMARY PROGRAM 3.6.2 DESIGN INFORMATION SUMMARY FORMAT AND CONTENT GUIDE 3.6.3 DESIGN INFORMATION SUMMARY LAYOUT GUIDE 3.6.4 DESIGN INFORMATION SUMMARY USERS' GUIDE 3.6.5 FINAL VERIFICATION OF DESIGN INFORMATION SUMMARIES 3.6.6 ISSUANCE OF DESIGN INFORMATION SUMMARIES 3.6.7 FIELD VALIDATION OF DESIGN INFORMATION SUMMARIES 3.6.8 MAINTENANCE AND CONTROL OF DESIGN INFORMATION SUMMARIES 3.7 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN RECONSTITUTION Chapter 4 4.1 Preliminary MCA Phase 4.2 Detailed MCA Phase 4.3 Life Extension Techniques 4.4 Ongoing MCA Phase 4.5 Specific Application of Graded Approach: MCA Adjunct Program Appendix II-A, Design Control Appendix II-B, Examples of Design Information Appendix II-C, Conduct of Walkdowns Appendix II-D, Content of Design Information Summaries Concluding Material doe-std-1073-93-ch4.pdf CONTENTS Chapter 2 2.1 Program Management Element 2.2 Design Requirements Element 2.3 Document Control Element 2.4 Change Control Element 2.5 Assessments Element Chapter 3 3.1 Program Plans and Procedures 3.2 Identification and Retrieval of Design Information 3.3 Evaluation, Verification, and Validation of Design Information 3.4 Resolution of Discrepancies 3.5 Regeneration of Missing Critical Design Information 3.6 Preparation and Issuance of Design Information Summaries 3.7 Specific Application of Graded Approach: Design Reconstitution CHAPTER 4 IMPLEMENTATION GUIDANCE FOR MATERIAL CONDITION AND AGING MANAGEMENT 4.1 PRELIMINARY MCA PHASE 4.1.1 COMPONENT SCREENING 4.1.2 AGING DEGRADATION MECHANISM EVALUATIONS 4.1.3 ESTIMATION OF FACILITY REMAINING LIFETIME 4.1.4 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS 4.1.5 MCA PROGRAM PLAN 4.2 DETAILED MCA PHASE 4.2.1 MCA ACTION PLAN AND PROCEDURES 4.2.2 FINAL IDENTIFICATION OF LIFE-LIMITING COMPONENTS 4.2.3 DETAILED AGING DEGRADATION EVALUATIONS 4.2.4 DETERMINATION OF FACILITY REMAINING LIFETIME 4.2.5 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS

4.3 LIFE EXTENSION TECHNIQUES 4.4 ONGOING MCA PHASE 4.4.1 DEGRADATION TRENDING 4.4.2 APPLICATION OF LIFE EXTENSION TECHNIQUES 4.5 SPECIFIC APPLICATION OF GRADED APPROACH: MCA ADJUNCT PROGRAM Appendix II-A, Design Control Appendix II-B, Examples of Design Information Appendix II-C, Conduct of Walkdowns Appendix II-D, Content of Design Information Summaries Concluding Material doe-std-1073-93-app_a.pdf CONTENTS CHAPTER 2 IMPLEMENTATION GUIDANCE FOR OPERATIONAL CONFIGURATION MANAGEMENT 2.1 PROGRAM MANAGEMENT ELEMENT 2.1.1 PROGRAM PLANNING 2.1.2 INTERFACES 2.1.3 DATABASES 2.1.4 CONFIGURATION MANAGEMENT PROCEDURES 2.1.5 SPECIFIC APPLICATION OF GRADED APPROACH: PROGRAM MANAGEMENT ELEMENT 2.2 DESIGN REQUIREMENTS ELEMENT 2.2.1 ESTABLISHMENT OF DESIGN REQUIREMENTS AND DESIGN BASIS 2.2.2 ASSIGNMENT OF SSC GRADES 2.2.3 FULLY DEVELOPED ELEMENT 2.2.4 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN REQUIREMENTS ELEMENT 2.3 DOCUMENT CONTROL ELEMENT 2.3.1 INITIAL DEVELOPMENT ACTIVITIES 2.3.2 FULLY DEVELOPED ELEMENT 2.3.3 SPECIFIC APPLICATION OF GRADED APPROACH: DOCUMENT CONTROL ELEMENT 2.4 CHANGE CONTROL ELEMENT 2.4.1 INITIAL DEVELOPMENT ACTIVITIES 2.4.2 FULLY DEVELOPED ELEMENT 2.4.3 SPECIFIC APPLICATION OF GRADED APPROACH: CHANGE CONTROL ELEMENT 2.5 ASSESSMENTS ELEMENT 2.5.1 INITIAL ASSESSMENTS 2.5.2 POST-IMPLEMENTATION ASSESSMENTS 2.5.3 ONGOING ASSESSMENTS 2.5.4 SPECIFIC APPLICATION OF GRADED APPROACH: ASSESSMENTS ELEMENT CHAPTER 3 IMPLEMENTATION GUIDANCE FOR DESIGN RECONSTITUTION 3.1 PROGRAM PLANS AND PROCEDURES 3.1.1 DESIGN RECONSTITUTION PROGRAM PLAN 3.1.2 DESIGN RECONSTITUTION ACTION PLAN 3.1.3 DESIGN RECONSTITUTION PROGRAM GOVERNING AND IMPLEMENTING PROCEDURES 3.2 IDENTIFICATION AND RETRIEVAL OF DESIGN INFORMATION 3.2.1 IDENTIFICATION AND RETRIEVAL OF SOURCE DOCUMENTS 3.2.2 EXTRACTION OF DESIGN INFORMATION 3.3 EVALUATION, VERIFICATION, AND VALIDATION OF DESIGN INFORMATION 3.3.1 VERIFICATION OF DESIGN INFORMATION 3.3.2 TECHNICAL VALIDATION OF DESIGN INFORMATION 3.3.3 RELEASE OF VERIFIED AND VALIDATED DESIGN INFORMATION 3.3.4 CORRELATION OF DESIGN BASIS TO DESIGN REQUIREMENTS 3.3.5 TECHNICAL MANAGEMENT REVIEW OF DESIGN INFORMATION 3.4 RESOLUTION OF DISCREPANCIES 3.5 REGENERATION OF MISSING CRITICAL DESIGN INFORMATION 3.5.1 REGENERATION OF DESIGN REQUIREMENTS 3.5.2 REGENERATION OF DESIGN BASIS 3.6 PREPARATION AND ISSUANCE OF DESIGN INFORMATION SUMMARIES 3.6.1 PILOT DESIGN INFORMATION SUMMARY PROGRAM 3.6.2 DESIGN INFORMATION SUMMARY FORMAT AND CONTENT GUIDE 3.6.3 DESIGN INFORMATION SUMMARY LAYOUT GUIDE 3.6.4 DESIGN INFORMATION SUMMARY USERS' GUIDE 3.6.5 FINAL VERIFICATION OF DESIGN INFORMATION SUMMARIES 3.6.6 ISSUANCE OF DESIGN INFORMATION SUMMARIES 3.6.7 FIELD VALIDATION OF DESIGN INFORMATION SUMMARIES 3.6.8 MAINTENANCE AND CONTROL OF DESIGN INFORMATION SUMMARIES 3.7 SPECIFIC APPLICATION OF GRADED APPROACH: DESIGN RECONSTITUTION CHAPTER 4 IMPLEMENTATION GUIDANCE FOR MATERIAL CONDITION AND AGING MANAGEMENT 4.1 PRELIMINARY MCA PHASE 4.1.1 COMPONENT SCREENING 4.1.2 AGING DEGRADATION MECHANISM EVALUATIONS 4.1.3 ESTIMATION OF FACILITY REMAINING LIFETIME 4.1.4 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS 4.1.5 MCA PROGRAM PLAN 4.2 DETAILED MCA PHASE 4.2.1 MCA ACTION PLAN AND PROCEDURES 4.2.2 FINAL IDENTIFICATION OF LIFE-LIMITING COMPONENTS 4.2.3 DETAILED AGING DEGRADATION EVALUATIONS 4.2.4 DETERMINATION OF FACILITY REMAINING LIFETIME 4.2.5 FEASIBILITY OF CONTINUED OPERATIONS AND EXTENDED OPERATIONS 4.3 LIFE EXTENSION TECHNIQUES 4.4 ONGOING MCA PHASE 4.4.1 DEGRADATION TRENDING 4.4.2 APPLICATION OF LIFE EXTENSION TECHNIQUES 4.5 SPECIFIC APPLICATION OF GRADED APPROACH: MCA ADJUNCT PROGRAM APPENDIX lI–A DESIGN CONTROL APPENDIX II–B EXAMPLES OF DESIGN INFORMATION APPENDIX II–C CONDUCT OF WALKDOWNS APPENDIX II–D CONTENT OF DESIGN INFORMATION SUMMARIES CONCLUDING MATERIAL